Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-03-2021 13:42
Static task
static1
Behavioral task
behavioral1
Sample
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
-
Size
137KB
-
MD5
d5927b50fee01b5fc563ece542455e23
-
SHA1
15c86056e1c53a9aad940d29c614e22cfde541d1
-
SHA256
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6
-
SHA512
cb08f4a454686612b33a5f1dc62ce00f4209738b8ddcdb0da867871cf341cbef2937ba3913a8cc1a0643b079905e7c3c4cb75e4ea1f264acf51874f8261ea2da
Malware Config
Extracted
Family
systembc
C2
178.20.41.149:4001
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exedescription ioc process File created C:\Windows\Tasks\wow64.job 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe File opened for modification C:\Windows\Tasks\wow64.job 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1528 wrote to memory of 1380 1528 taskeng.exe 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe PID 1528 wrote to memory of 1380 1528 taskeng.exe 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe PID 1528 wrote to memory of 1380 1528 taskeng.exe 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe PID 1528 wrote to memory of 1380 1528 taskeng.exe 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe"C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {E731CFEA-4823-4278-B07D-844F911A62FD} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exeC:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-2-0x00000000030E0000-0x00000000030F1000-memory.dmpFilesize
68KB
-
memory/776-3-0x0000000076071000-0x0000000076073000-memory.dmpFilesize
8KB
-
memory/776-4-0x0000000000020000-0x0000000000025000-memory.dmpFilesize
20KB
-
memory/776-5-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1380-6-0x0000000000000000-mapping.dmp
-
memory/1380-7-0x0000000002DB0000-0x0000000002DC1000-memory.dmpFilesize
68KB