Analysis
-
max time kernel
61s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-07-2021 11:21
Static task
static1
Behavioral task
behavioral1
Sample
32b16aac379f192f71c5c46b6cd8f176.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
32b16aac379f192f71c5c46b6cd8f176.exe
-
Size
627KB
-
MD5
32b16aac379f192f71c5c46b6cd8f176
-
SHA1
fa0a0e78eaffb35cd2e1d7b3749e81de551b0661
-
SHA256
84942f3b5f4ddd9f393b42d5a1968a4b5bf5bbf45de0c6a95eba61eb20dc5070
-
SHA512
6fa7194e5be6e71f9a16b7cc19cb0703113ae885044b90aca6f7c1e8a79c8fc21b405ae2f9245c4d68ecc76c531c37ea6803ce9a71b7ace8851cecb9100212fc
Malware Config
Extracted
Family
systembc
C2
185.215.113.32:4000
78.47.64.46:4000
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
32b16aac379f192f71c5c46b6cd8f176.exedescription ioc process File created C:\Windows\Tasks\wow64.job 32b16aac379f192f71c5c46b6cd8f176.exe File opened for modification C:\Windows\Tasks\wow64.job 32b16aac379f192f71c5c46b6cd8f176.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1328 wrote to memory of 1532 1328 taskeng.exe 32b16aac379f192f71c5c46b6cd8f176.exe PID 1328 wrote to memory of 1532 1328 taskeng.exe 32b16aac379f192f71c5c46b6cd8f176.exe PID 1328 wrote to memory of 1532 1328 taskeng.exe 32b16aac379f192f71c5c46b6cd8f176.exe PID 1328 wrote to memory of 1532 1328 taskeng.exe 32b16aac379f192f71c5c46b6cd8f176.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe"C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {203C51E1-88CF-47EA-B64E-FF7A8353DD6C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exeC:\Users\Admin\AppData\Local\Temp\32b16aac379f192f71c5c46b6cd8f176.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1072-59-0x00000000768B1000-0x00000000768B3000-memory.dmpFilesize
8KB
-
memory/1072-61-0x0000000000270000-0x0000000000275000-memory.dmpFilesize
20KB
-
memory/1072-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1072-62-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1532-63-0x0000000000000000-mapping.dmp
-
memory/1532-65-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1532-67-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB