Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 13:42
Static task
static1
Behavioral task
behavioral1
Sample
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
-
Size
137KB
-
MD5
d5927b50fee01b5fc563ece542455e23
-
SHA1
15c86056e1c53a9aad940d29c614e22cfde541d1
-
SHA256
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6
-
SHA512
cb08f4a454686612b33a5f1dc62ce00f4209738b8ddcdb0da867871cf341cbef2937ba3913a8cc1a0643b079905e7c3c4cb75e4ea1f264acf51874f8261ea2da
Malware Config
Extracted
Family
systembc
C2
178.20.41.149:4001
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exedescription ioc process File created C:\Windows\Tasks\wow64.job 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe File opened for modification C:\Windows\Tasks\wow64.job 69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe"C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe"1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exeC:\Users\Admin\AppData\Local\Temp\69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6.exe start1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-5-0x0000000003240000-0x0000000003241000-memory.dmpFilesize
4KB
-
memory/1456-2-0x0000000003210000-0x0000000003211000-memory.dmpFilesize
4KB
-
memory/1456-3-0x0000000000030000-0x0000000000035000-memory.dmpFilesize
20KB
-
memory/1456-4-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB