Analysis
- max time kernel
22s - max time network
134s - platform
windows10_x64 - resource
win10-en - submitted
07/09/2021, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe
- Size 229KB
- Sample210907-s2eyyschb4
- SHA256 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0
- MD5 3de1f88ca994482e852010ef0efb333e
- SHA1 52bdc92f01baa2c62e18d40af7a58121ec0dfa28
- SHA512 4459cb7581d3c6b0ce159ade11827dc1ed793141f1744ae8cecd78504842c74da36eb99fbf53ab2863773c7b07803ead542c1981c813b2b2b6ac4eaf08c1314c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
gootkit
Botnet
-
4444
C2
-
secure256bit.at
-
secure2048.at
Attributes
-
vendor_id
4444
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4528 set thread context of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe 4212 mstsc.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4528 wrote to memory of 4268 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 79 PID 4528 wrote to memory of 4268 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 79 PID 4528 wrote to memory of 4268 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 79 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4528 wrote to memory of 4252 4528 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 80 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4252 wrote to memory of 4212 4252 5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe 81 PID 4212 wrote to memory of 4348 4212 mstsc.exe 82 PID 4212 wrote to memory of 4348 4212 mstsc.exe 82 PID 4212 wrote to memory of 4348 4212 mstsc.exe 82 PID 4348 wrote to memory of 4388 4348 cmd.exe 84 PID 4348 wrote to memory of 4388 4348 cmd.exe 84 PID 4348 wrote to memory of 4388 4348 cmd.exe 84 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4388 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe"C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exeC:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe2⤵PID:4268
-
-
C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exeC:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\mstsc.exeC:\Windows\System32\mstsc.exe "C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\259275156.bat" "C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe""4⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\attrib.exeattrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\5eb9121d5de5ab6ee44a89c29622c49fae4f5d1c7178929964b3adaa5d8623e0.exe"5⤵
- Views/modifies file attributes
PID:4388
-
-
-
-