Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
01-10-2020 23:32
Static task
static1
Behavioral task
behavioral1
Sample
448838b2a60484ee78c2198f2c0c9c85.bin.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
448838b2a60484ee78c2198f2c0c9c85.bin.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
448838b2a60484ee78c2198f2c0c9c85.bin.exe
-
Size
115KB
-
MD5
448838b2a60484ee78c2198f2c0c9c85
-
SHA1
f2c43a01cabaa694228f5354ea8c6bcf3b7a49b3
-
SHA256
64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273
-
SHA512
9e532af06e5f4764529211e8c5c749baa7b01c72f11b603218c3c08d70cf1e732f8d9d81ec257ca247aaa96d1502150a2f402b1b3914780b6344222b007dd53f
Score
10/10
Malware Config
Signatures
-
SlothfulMedia
SlothfulMedia is a malware used by sophisticated threat actors that drops a remote access tool.
-
SlothfulMedia Main Payload 2 IoCs
resource yara_rule behavioral2/files/0x000200000001ad98-2.dat family_slothfulmedia behavioral2/files/0x000200000001ad98-1.dat family_slothfulmedia -
Executes dropped EXE 2 IoCs
pid Process 1080 mediaplayer.exe 3536 WsxZT.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\International\Geo\Nation 448838b2a60484ee78c2198f2c0c9c85.bin.exe -
Deletes itself 1 IoCs
pid Process 3536 WsxZT.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 448838b2a60484ee78c2198f2c0c9c85.bin.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3692 wrote to memory of 1080 3692 448838b2a60484ee78c2198f2c0c9c85.bin.exe 73 PID 3692 wrote to memory of 1080 3692 448838b2a60484ee78c2198f2c0c9c85.bin.exe 73 PID 3692 wrote to memory of 1080 3692 448838b2a60484ee78c2198f2c0c9c85.bin.exe 73 PID 3692 wrote to memory of 3536 3692 448838b2a60484ee78c2198f2c0c9c85.bin.exe 74 PID 3692 wrote to memory of 3536 3692 448838b2a60484ee78c2198f2c0c9c85.bin.exe 74 PID 3692 wrote to memory of 3536 3692 448838b2a60484ee78c2198f2c0c9c85.bin.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\448838b2a60484ee78c2198f2c0c9c85.bin.exe"C:\Users\Admin\AppData\Local\Temp\448838b2a60484ee78c2198f2c0c9c85.bin.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe"C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe"2⤵
- Executes dropped EXE
PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\WsxZT.exe"C:\Users\Admin\AppData\Local\Temp\WsxZT.exe"2⤵
- Executes dropped EXE
- Deletes itself
PID:3536
-