Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-12-2020 20:20
Static task
static1
Behavioral task
behavioral1
Sample
64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
Resource
win10v20201028
General
-
Target
64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe
-
Size
115KB
-
MD5
448838b2a60484ee78c2198f2c0c9c85
-
SHA1
f2c43a01cabaa694228f5354ea8c6bcf3b7a49b3
-
SHA256
64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273
-
SHA512
9e532af06e5f4764529211e8c5c749baa7b01c72f11b603218c3c08d70cf1e732f8d9d81ec257ca247aaa96d1502150a2f402b1b3914780b6344222b007dd53f
Malware Config
Signatures
-
SlothfulMedia
SlothfulMedia is a malware used by sophisticated threat actors that drops a remote access tool.
-
SlothfulMedia Main Payload 2 IoCs
resource yara_rule behavioral2/files/0x0004000000015253-3.dat family_slothfulmedia behavioral2/files/0x0004000000015253-4.dat family_slothfulmedia -
Executes dropped EXE 2 IoCs
pid Process 2512 mediaplayer.exe 2168 p_DMO.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe -
Deletes itself 1 IoCs
pid Process 2168 p_DMO.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 492 wrote to memory of 2512 492 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe 75 PID 492 wrote to memory of 2512 492 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe 75 PID 492 wrote to memory of 2512 492 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe 75 PID 492 wrote to memory of 2168 492 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe 76 PID 492 wrote to memory of 2168 492 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe 76 PID 492 wrote to memory of 2168 492 64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe"C:\Users\Admin\AppData\Local\Temp\64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe"C:\Users\Admin\AppData\Roaming\Media\mediaplayer.exe"2⤵
- Executes dropped EXE
PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\p_DMO.exe"C:\Users\Admin\AppData\Local\Temp\p_DMO.exe"2⤵
- Executes dropped EXE
- Deletes itself
PID:2168
-