Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09-07-2021 09:08
Static task
static1
Behavioral task
behavioral1
Sample
7f17f223e4da250bfe4bfff2fc91bc13.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
7f17f223e4da250bfe4bfff2fc91bc13.exe
-
Size
718KB
-
MD5
7f17f223e4da250bfe4bfff2fc91bc13
-
SHA1
1172ef0932115441dec43378f15d74f42fdb1d42
-
SHA256
12acd7745d22a1b295e3fd96e3994a2a36d456df3cab6f3493942c79e942a43b
-
SHA512
8db28083b68fb8283d3a22ee2c59c5d9b1471bd2c0448a0f63ab2373b05a87e991b7601d2e4d4e7e26865403823f6c7d4c7c367ee52b28d5da2b9b93318193c0
Malware Config
Extracted
Family
systembc
C2
185.215.113.32:4000
78.47.64.46:4000
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
7f17f223e4da250bfe4bfff2fc91bc13.exedescription ioc process File created C:\Windows\Tasks\wow64.job 7f17f223e4da250bfe4bfff2fc91bc13.exe File opened for modification C:\Windows\Tasks\wow64.job 7f17f223e4da250bfe4bfff2fc91bc13.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1696 wrote to memory of 1768 1696 taskeng.exe 7f17f223e4da250bfe4bfff2fc91bc13.exe PID 1696 wrote to memory of 1768 1696 taskeng.exe 7f17f223e4da250bfe4bfff2fc91bc13.exe PID 1696 wrote to memory of 1768 1696 taskeng.exe 7f17f223e4da250bfe4bfff2fc91bc13.exe PID 1696 wrote to memory of 1768 1696 taskeng.exe 7f17f223e4da250bfe4bfff2fc91bc13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f17f223e4da250bfe4bfff2fc91bc13.exe"C:\Users\Admin\AppData\Local\Temp\7f17f223e4da250bfe4bfff2fc91bc13.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {95F947D9-9AB0-4F93-86EA-F01CDE869E0C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f17f223e4da250bfe4bfff2fc91bc13.exeC:\Users\Admin\AppData\Local\Temp\7f17f223e4da250bfe4bfff2fc91bc13.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1768-64-0x0000000000000000-mapping.dmp
-
memory/1768-65-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1768-68-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1944-60-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1944-62-0x0000000000300000-0x0000000000305000-memory.dmpFilesize
20KB
-
memory/1944-63-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1944-61-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB