Resubmissions
23-12-2021 18:20
211223-wyzqqsccdl 1023-12-2021 14:03
211223-rc7f8shhg2 1023-12-2021 11:13
211223-nbh6gaader 1015-08-2021 20:58
210815-ycewjd1mge 10Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
23-12-2021 18:20
Static task
static1
Behavioral task
behavioral1
Sample
4594A8618274C5732C58BCB6F246919A.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4594A8618274C5732C58BCB6F246919A.exe
Resource
win10-en-20211208
General
-
Target
4594A8618274C5732C58BCB6F246919A.exe
-
Size
2.1MB
-
MD5
4594a8618274c5732c58bcb6f246919a
-
SHA1
4f8713c078388eb8d06f24d4549a8175e8135b65
-
SHA256
93dd445822c1c5b30270fc5552a71a02eab536a80ba51e345632d2be18aded49
-
SHA512
6615279fa9e7f72a3c42eeb01e96ae00ed3804e71456e044c574e1a732c43b04df9b42258099326f23d0bc6d4356995f2ee3b192e9b0f246cdf75af43f5e7fe3
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9083
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
winlogomwindefenders
-
install_file
winlogomwindefender.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4380-125-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4380-127-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4380-128-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe" 4594A8618274C5732C58BCB6F246919A.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe䘀" 4594A8618274C5732C58BCB6F246919A.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exepid process 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exedescription pid process target process PID 3664 set thread context of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe -
Suspicious behavior: RenamesItself 18 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exepid process 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exedescription pid process Token: SeShutdownPrivilege 4380 4594A8618274C5732C58BCB6F246919A.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exepid process 4380 4594A8618274C5732C58BCB6F246919A.exe 4380 4594A8618274C5732C58BCB6F246919A.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
4594A8618274C5732C58BCB6F246919A.exedescription pid process target process PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe PID 3664 wrote to memory of 4380 3664 4594A8618274C5732C58BCB6F246919A.exe 4594A8618274C5732C58BCB6F246919A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4594A8618274C5732C58BCB6F246919A.exe"C:\Users\Admin\AppData\Local\Temp\4594A8618274C5732C58BCB6F246919A.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4594A8618274C5732C58BCB6F246919A.exe"C:\Users\Admin\AppData\Local\Temp\4594A8618274C5732C58BCB6F246919A.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3664-115-0x00000000008C0000-0x0000000000ADA000-memory.dmpFilesize
2.1MB
-
memory/3664-116-0x00000000008C0000-0x0000000000ADA000-memory.dmpFilesize
2.1MB
-
memory/3664-117-0x0000000005930000-0x0000000005E2E000-memory.dmpFilesize
5.0MB
-
memory/3664-118-0x00000000054D0000-0x0000000005562000-memory.dmpFilesize
584KB
-
memory/3664-119-0x0000000005570000-0x000000000560C000-memory.dmpFilesize
624KB
-
memory/3664-120-0x0000000005430000-0x000000000592E000-memory.dmpFilesize
5.0MB
-
memory/3664-121-0x0000000005440000-0x000000000544A000-memory.dmpFilesize
40KB
-
memory/3664-122-0x0000000005780000-0x0000000005796000-memory.dmpFilesize
88KB
-
memory/3664-123-0x00000000080E0000-0x00000000082D0000-memory.dmpFilesize
1.9MB
-
memory/3664-124-0x000000000B850000-0x000000000B9C8000-memory.dmpFilesize
1.5MB
-
memory/4380-125-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4380-126-0x00000000007E2780-mapping.dmp
-
memory/4380-127-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4380-128-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB