Analysis
-
max time kernel
62s -
max time network
172s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-07-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
80a8f2eeb88a172085ef05f8e99a7de8.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
80a8f2eeb88a172085ef05f8e99a7de8.exe
-
Size
515KB
-
MD5
80a8f2eeb88a172085ef05f8e99a7de8
-
SHA1
db3160eac7dba9fc00ffb5a3e6901f4e10817dc7
-
SHA256
5c438f86021fd06082e385cbc634358ff271f5cc2402fa2fcc7356dd00370925
-
SHA512
f6c093b32354020fd8b90bc2e8b0790f9ec53415e4853f04ee3f6de800529659e77a2c758aec1fa2539bc4e8cf192316826785393f82826a1cc81f9bddde4146
Malware Config
Extracted
Family
systembc
C2
185.215.113.32:4000
78.47.64.46:4000
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
80a8f2eeb88a172085ef05f8e99a7de8.exedescription ioc process File created C:\Windows\Tasks\wow64.job 80a8f2eeb88a172085ef05f8e99a7de8.exe File opened for modification C:\Windows\Tasks\wow64.job 80a8f2eeb88a172085ef05f8e99a7de8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1368 wrote to memory of 1644 1368 taskeng.exe 80a8f2eeb88a172085ef05f8e99a7de8.exe PID 1368 wrote to memory of 1644 1368 taskeng.exe 80a8f2eeb88a172085ef05f8e99a7de8.exe PID 1368 wrote to memory of 1644 1368 taskeng.exe 80a8f2eeb88a172085ef05f8e99a7de8.exe PID 1368 wrote to memory of 1644 1368 taskeng.exe 80a8f2eeb88a172085ef05f8e99a7de8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe"C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {ED904443-495A-4360-9E90-14E6B465E93C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exeC:\Users\Admin\AppData\Local\Temp\80a8f2eeb88a172085ef05f8e99a7de8.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-59-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/1092-61-0x0000000000280000-0x0000000000285000-memory.dmpFilesize
20KB
-
memory/1092-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1092-62-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1644-63-0x0000000000000000-mapping.dmp
-
memory/1644-64-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1644-67-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB