Analysis
-
max time kernel
131s -
max time network
182s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 20:47
Static task
static1
Behavioral task
behavioral1
Sample
1d29d6cd39010976adcb9fcba517f3bc.exe
Resource
win7v20210408
0 signatures
0 seconds
General
-
Target
1d29d6cd39010976adcb9fcba517f3bc.exe
-
Size
117KB
-
MD5
1d29d6cd39010976adcb9fcba517f3bc
-
SHA1
86d13d8593d4eea9e5b8c9dca9a1d30c7c03f67c
-
SHA256
c27741b9e50da0c369b848179c9a4f9b0362b6d5e384055c6c72fc9667a270ec
-
SHA512
fb332b210b5c8549097d55740d09ff06c9beabe40c2c020013e59f429df29c3b0cb7925de4eafb536b299361ea2b533c65a133ee6784e594574441ed04b09c48
Malware Config
Extracted
Family
systembc
C2
195.2.76.80:4001
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
1d29d6cd39010976adcb9fcba517f3bc.exedescription ioc process File created C:\Windows\Tasks\wow64.job 1d29d6cd39010976adcb9fcba517f3bc.exe File opened for modification C:\Windows\Tasks\wow64.job 1d29d6cd39010976adcb9fcba517f3bc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1456 wrote to memory of 816 1456 taskeng.exe 1d29d6cd39010976adcb9fcba517f3bc.exe PID 1456 wrote to memory of 816 1456 taskeng.exe 1d29d6cd39010976adcb9fcba517f3bc.exe PID 1456 wrote to memory of 816 1456 taskeng.exe 1d29d6cd39010976adcb9fcba517f3bc.exe PID 1456 wrote to memory of 816 1456 taskeng.exe 1d29d6cd39010976adcb9fcba517f3bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d29d6cd39010976adcb9fcba517f3bc.exe"C:\Users\Admin\AppData\Local\Temp\1d29d6cd39010976adcb9fcba517f3bc.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {BDC519F3-F310-48CF-8E7B-4AAEFB4DF301} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d29d6cd39010976adcb9fcba517f3bc.exeC:\Users\Admin\AppData\Local\Temp\1d29d6cd39010976adcb9fcba517f3bc.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-59-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/628-60-0x00000000001B0000-0x00000000001B5000-memory.dmpFilesize
20KB
-
memory/628-61-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB
-
memory/816-62-0x0000000000000000-mapping.dmp
-
memory/816-64-0x0000000000400000-0x00000000004A4000-memory.dmpFilesize
656KB