Overview
overview
8Static
static
1.exe
windows7_x64
11.exe
windows10_x64
8Fallen.exe
windows7_x64
8Fallen.exe
windows10_x64
8Inte.exe
windows7_x64
8Inte.exe
windows10_x64
8LX64
windows7_x64
1LX64
windows10_x64
1Server.exe
windows7_x64
8Server.exe
windows10_x64
8hfs.exe
windows7_x64
6hfs.exe
windows10_x64
6hfs_1.exe
windows7_x64
6hfs_1.exe
windows10_x64
6hg
windows7_x64
1hg
windows10_x64
1java
windows7_x64
1java
windows10_x64
1moren.exe
windows7_x64
6moren.exe
windows10_x64
6Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
10-03-2020 00:09
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7v200217
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v200217
Behavioral task
behavioral3
Sample
Fallen.exe
Resource
win7v200217
Behavioral task
behavioral4
Sample
Fallen.exe
Resource
win10v200217
Behavioral task
behavioral5
Sample
Inte.exe
Resource
win7v200217
Behavioral task
behavioral6
Sample
Inte.exe
Resource
win10v200217
Behavioral task
behavioral7
Sample
LX64
Resource
win7v200217
Behavioral task
behavioral8
Sample
LX64
Resource
win10v200217
Behavioral task
behavioral9
Sample
Server.exe
Resource
win7v200217
Behavioral task
behavioral10
Sample
Server.exe
Resource
win10v200217
Behavioral task
behavioral11
Sample
hfs.exe
Resource
win7v200217
Behavioral task
behavioral12
Sample
hfs.exe
Resource
win10v200217
Behavioral task
behavioral13
Sample
hfs_1.exe
Resource
win7v200217
Behavioral task
behavioral14
Sample
hfs_1.exe
Resource
win10v200217
Behavioral task
behavioral15
Sample
hg
Resource
win7v200217
Behavioral task
behavioral16
Sample
hg
Resource
win10v200217
Behavioral task
behavioral17
Sample
java
Resource
win7v200217
Behavioral task
behavioral18
Sample
java
Resource
win10v200217
Behavioral task
behavioral19
Sample
moren.exe
Resource
win7v200217
Behavioral task
behavioral20
Sample
moren.exe
Resource
win10v200217
General
-
Target
moren.exe
-
Size
153KB
-
MD5
546cadaef5b11149fa02b146dfa0b830
-
SHA1
07b8527cc5561481d1e25842bd1ab3182684df4a
-
SHA256
05feb29bad25082dc351921f867287084275915c41fe242c47f21644d7a54558
-
SHA512
f1d8f618cbf9599f3efda6333b09d51f472d5f3a83d67ac04549084be787d522e3ece6272ff91322312252608ce8c69080e09dd4c52b9412489e7cf8459b79e0
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
moren.exepid process 4040 moren.exe 4040 moren.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
moren.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek¸ßÇåÎúÒôƵ¹ÜÀíÆ÷ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\moren.exe" moren.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4040-0-0x0000000010000000-0x000000001002B000-memory.dmpFilesize
172KB