Analysis
-
max time kernel
2s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-07-2021 19:16
Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2.exe
Resource
win10v20210408
General
-
Target
2.exe
-
Size
2.4MB
-
MD5
a1d45a1dfcf0c7b28819d2f3d9f8bd35
-
SHA1
48b754be9094106fa3813c27e0a5e928c006f7ab
-
SHA256
79b9e821bd34d0f1e5572eceb741caca3302cfaa4cfdf97c5ed78450355c4cbf
-
SHA512
6c250f3530d7d246dc656fd1bbac203bb98b3fda83691bb67f95bd99d716a13fb867cebea638578fb9cb1ad482388fe0bfb80f5949b7fb9ac78d354ad72a322b
Malware Config
Extracted
C:\Boot\Fonts\HOW TO RESTORE YOUR FILES.TXT
aid.keepcalm@seznam.cz
aid.keepcalm@protonmail.com
https://tox.chat/
Signatures
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2.execmd.exedescription pid process target process PID 568 wrote to memory of 996 568 2.exe cmd.exe PID 568 wrote to memory of 996 568 2.exe cmd.exe PID 996 wrote to memory of 1768 996 cmd.exe sc.exe PID 996 wrote to memory of 1768 996 cmd.exe sc.exe PID 996 wrote to memory of 1496 996 cmd.exe findstr.exe PID 996 wrote to memory of 1496 996 cmd.exe findstr.exe PID 568 wrote to memory of 2884 568 2.exe cmd.exe PID 568 wrote to memory of 2884 568 2.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\esuiuotu.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exeSC QUERY3⤵
-
C:\Windows\system32\findstr.exeFINDSTR SERVICE_NAME3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tlfegvlqgwwhn.bat2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\esuiuotu.batMD5
55310bb774fff38cca265dbc70ad6705
SHA1cb8d76e9fd38a0b253056e5f204dab5441fe932b
SHA2561fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d
SHA51240e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4
-
memory/996-114-0x0000000000000000-mapping.dmp
-
memory/1496-117-0x0000000000000000-mapping.dmp
-
memory/1768-116-0x0000000000000000-mapping.dmp
-
memory/2884-118-0x0000000000000000-mapping.dmp