Overview

overview

8

Static

static

1.exe

windows7_x64

1

1.exe

windows10_x64

8

Fallen.exe

windows7_x64

8

Fallen.exe

windows10_x64

8

Inte.exe

windows7_x64

8

Inte.exe

windows10_x64

8

LX64

windows7_x64

1

LX64

windows10_x64

1

Server.exe

windows7_x64

8

Server.exe

windows10_x64

8

hfs.exe

windows7_x64

6

hfs.exe

windows10_x64

6

hfs_1.exe

windows7_x64

6

hfs_1.exe

windows10_x64

6

hg

windows7_x64

1

hg

windows10_x64

1

java

windows7_x64

1

java

windows10_x64

1

moren.exe

windows7_x64

6

moren.exe

windows10_x64

6

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v200217
  • submitted
    10-03-2020 00:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fallen.exe

  • Size

    11KB

  • MD5

    1423f94092ba6a80ec571748e08d396e

  • SHA1

    3839e76d9f01f9a92304cab21aa130f5800f71d2

  • SHA256

    f595233fa17f4f280bd88b012419652b8d11f086ccc497ab5c796eba39498e60

  • SHA512

    197fb512e2ee4d4cd3bf499e70a1ffda8e107efc6e6a354622448b7dac575701d6f2288df97db568df7e27e780750bc4c3337ffc869adffbd21b013c69aba18f

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies service 2 TTPs 1 IoCs
    persistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fallen.exe
    "C:\Users\Admin\AppData\Local\Temp\Fallen.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Drops file in Windows directory
    • Modifies service
    PID:3792
  • C:\Windows\Server.exe
    C:\Windows\Server.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads