Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 15:22

General

  • Target

    d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe

  • Size

    52KB

  • MD5

    094312be0a71a292a4670bcda23b2500

  • SHA1

    b2b465baee22889403ba48c0745d5d9643a45555

  • SHA256

    d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc

  • SHA512

    dbe5895339a06d806b240333dd4a0be2767c36833ad6860b396c6013ca4c8483395534fb68b4c709922d512cf61d23ee5410f99a3dd633e13d94f6a2f44523b9

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3540

Network

  • flag-unknown
    DNS
    rackz.su
    Remote address:
    8.8.8.8:53
    Request
    rackz.su
    IN A
    Response
    rackz.su
    IN A
    170.106.35.220
  • flag-unknown
    POST
    http://rackz.su/gate.php
    explorer.exe
    Remote address:
    170.106.35.220:80
    Request
    POST /gate.php HTTP/1.1
    Connection: Keep-Alive
    Content-Length: 99
    Host: rackz.su
    Response
    HTTP/1.1 200 OK
    Date: Fri, 20 Nov 2020 15:43:44 GMT
    Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
    X-Powered-By: PHP/7.4.11
    Content-Length: 17
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-unknown
    POST
    http://rackz.su/gate.php
    explorer.exe
    Remote address:
    170.106.35.220:80
    Request
    POST /gate.php HTTP/1.1
    Connection: Keep-Alive
    Content-Length: 99
    Host: rackz.su
    Response
    HTTP/1.1 200 OK
    Date: Fri, 20 Nov 2020 15:44:45 GMT
    Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
    X-Powered-By: PHP/7.4.11
    Content-Length: 17
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-unknown
    POST
    http://rackz.su/gate.php
    explorer.exe
    Remote address:
    170.106.35.220:80
    Request
    POST /gate.php HTTP/1.1
    Connection: Keep-Alive
    Content-Length: 99
    Host: rackz.su
    Response
    HTTP/1.1 200 OK
    Date: Fri, 20 Nov 2020 15:45:45 GMT
    Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.11
    X-Powered-By: PHP/7.4.11
    Content-Length: 17
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 170.106.35.220:80
    http://rackz.su/gate.php
    http
    explorer.exe
    456 B
    447 B
    6
    5

    HTTP Request

    POST http://rackz.su/gate.php

    HTTP Response

    200
  • 170.106.35.220:80
    http://rackz.su/gate.php
    http
    explorer.exe
    456 B
    487 B
    6
    6

    HTTP Request

    POST http://rackz.su/gate.php

    HTTP Response

    200
  • 170.106.35.220:80
    http://rackz.su/gate.php
    http
    explorer.exe
    456 B
    487 B
    6
    6

    HTTP Request

    POST http://rackz.su/gate.php

    HTTP Response

    200
  • 8.8.8.8:53
    rackz.su
    dns
    54 B
    70 B
    1
    1

    DNS Request

    rackz.su

    DNS Response

    170.106.35.220

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2396-3-0x0000000001060000-0x0000000001065000-memory.dmp

    Filesize

    20KB

  • memory/3540-0-0x0000000002C10000-0x0000000002C1F000-memory.dmp

    Filesize

    60KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.