Overview
overview
10Static
static
8197f0e170f...2a.exe
windows7_x64
9197f0e170f...2a.exe
windows10_x64
9302d77c6ec...56.exe
windows7_x64
8302d77c6ec...56.exe
windows10_x64
8466d872ddb...0d.exe
windows7_x64
8466d872ddb...0d.exe
windows10_x64
106d13a07022...f4.exe
windows7_x64
86d13a07022...f4.exe
windows10_x64
88c1d1de824...ef.exe
windows7_x64
18c1d1de824...ef.exe
windows10_x64
1a31f1894f1...b8.exe
windows7_x64
8a31f1894f1...b8.exe
windows10_x64
9a3802c3a05...6d.exe
windows7_x64
10a3802c3a05...6d.exe
windows10_x64
10Android APK
android_x86_64
10c6c0d4969a...36.exe
windows7_x64
1c6c0d4969a...36.exe
windows10_x64
1d92ef7281e...1a.exe
windows7_x64
1d92ef7281e...1a.exe
windows10_x64
1dffb2eaccb...3a.exe
windows7_x64
8dffb2eaccb...3a.exe
windows10_x64
8e247b061c8...b1.exe
windows7_x64
8e247b061c8...b1.exe
windows10_x64
8Analysis
-
max time kernel
12s -
max time network
93s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-11-2020 02:32
Static task
static1
Behavioral task
behavioral1
Sample
197f0e170fac2b8c5f1b79d1865ce25f95f4b1a45408b091b5741710a3d9e32a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
197f0e170fac2b8c5f1b79d1865ce25f95f4b1a45408b091b5741710a3d9e32a.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
302d77c6ec68c07741be2ae0d0c26bc88c85f525c8e3766ebf23dba34802f956.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
302d77c6ec68c07741be2ae0d0c26bc88c85f525c8e3766ebf23dba34802f956.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
6d13a07022cd549f981cc929795c9c1b18c424a0faff27c1faa8990ca843c6f4.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
8c1d1de824c079bfec155f05b5f24fd4e1c64c015286ac417b3a587124d743ef.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
a31f1894f161f1005c00ad43235500691a4fd0cb7bd83945d47f16dbd7f62ab8.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
a31f1894f161f1005c00ad43235500691a4fd0cb7bd83945d47f16dbd7f62ab8.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
a3802c3a0538d8b24b8a43144c51e742b0041e3b983b654ee19639359c42b06d.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
af82bed2c58c403908faf323310cf6a65a7e3bfe098cc930eb5ac4bfe9315ef4.apk
Resource
android-x86_64
Behavioral task
behavioral16
Sample
c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
Resource
win7v20201028
Behavioral task
behavioral17
Sample
c6c0d4969ac74cdc574fae3ace12a4ad64858ec5ab292733ae78fd3d04696536.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
d92ef7281e3b5145835ffa17ff869c5569011ffb9ad327eeecfddebe31cdc31a.exe
Resource
win7v20201028
Behavioral task
behavioral19
Sample
d92ef7281e3b5145835ffa17ff869c5569011ffb9ad327eeecfddebe31cdc31a.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
Resource
win7v20201028
Behavioral task
behavioral21
Sample
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
Resource
win7v20201028
Behavioral task
behavioral23
Sample
e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
Resource
win10v20201028
General
-
Target
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
-
Size
8.6MB
-
MD5
3c4261d71d948d16d40c36805295a62b
-
SHA1
0cf36394c41e79b2297c18ebc8fd0d0ee1ffdd9d
-
SHA256
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a
-
SHA512
b7e6e153a68bb4ee5257e86a9ab7637db161ced3681f306217cb4d4fea2f63cd6eca54c662ca8a6509d94fc44cca0785a528371f95fe83f5442e9c213fe0febb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exepid process 508 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe vmprotect C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exedffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exepid process 1304 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe 508 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exedffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exepid process 1304 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe 1304 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe 508 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe 508 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exepid process 1304 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exedffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exedescription pid process target process PID 1304 wrote to memory of 508 1304 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe PID 1304 wrote to memory of 508 1304 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe PID 508 wrote to memory of 1376 508 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe cmd.exe PID 508 wrote to memory of 1376 508 dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:1376
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
MD53088fde5b97f22859b11eab2a0c6854e
SHA10a66943916eb904cb8815d3d8e550db0fdf14b71
SHA2567301584cf657694aecb7ec6aa55c8025d9d88e4ceadc8bd0513e4c37ec00462b
SHA512f22849b3b299f6b51b75d7415f7374067e8d364451b64339c1666b8587583bb09a428f7524d008ab14cb9adb940d21937eb5f347a956ffee9cc85f09b10109ab
-
C:\Users\Admin\AppData\Local\Temp\dffb2eaccbbfd1077d7679ecba62bb75de32259c70e28a84b32750fdfb17e13a.exe
MD53088fde5b97f22859b11eab2a0c6854e
SHA10a66943916eb904cb8815d3d8e550db0fdf14b71
SHA2567301584cf657694aecb7ec6aa55c8025d9d88e4ceadc8bd0513e4c37ec00462b
SHA512f22849b3b299f6b51b75d7415f7374067e8d364451b64339c1666b8587583bb09a428f7524d008ab14cb9adb940d21937eb5f347a956ffee9cc85f09b10109ab