Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
06-01-2022 11:55
Static task
static1
Behavioral task
behavioral1
Sample
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe
-
Size
2.3MB
-
MD5
5effe6792620b5d512905695003baa3f
-
SHA1
0a98f5acfcd5a0efb4989d4513b6b8861438777d
-
SHA256
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5
-
SHA512
67630485b4cd44a612274c146aabef67b5d0f0c0ddfb0f8c34367985e43ccef25cd35d8583952bc73281b5fedb9d8e05a67ad326cdfae9c67ae858ce2c2c1a09
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
91.243.32.131:80
Attributes
-
communication_password
202cb962ac59075b964b07152d234b70
-
install_dir
Defenderzone
-
install_file
syspro.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe" ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exe넀" ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\syspro = "C:\\Users\\Admin\\AppData\\Local\\Defenderzone\\syspro.exeᤀ" ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exepid process 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exepid process 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe -
Suspicious behavior: RenamesItself 29 IoCs
Processes:
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exepid process 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exedescription pid process Token: SeShutdownPrivilege 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exepid process 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe 1856 ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe"C:\Users\Admin\AppData\Local\Temp\ed857cb8db7feb60827f28be33098db83bb25fa2191b133eedc5b4b29907abd5.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1856-115-0x0000000000910000-0x0000000000A5A000-memory.dmpFilesize
1.3MB
-
memory/1856-116-0x0000000000400000-0x0000000000842000-memory.dmpFilesize
4.3MB
-
memory/1856-117-0x0000000000400000-0x0000000000842000-memory.dmpFilesize
4.3MB
-
memory/1856-118-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1856-119-0x0000000000400000-0x0000000000842000-memory.dmpFilesize
4.3MB
-
memory/1856-120-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/1856-121-0x0000000073A60000-0x0000000073C22000-memory.dmpFilesize
1.8MB
-
memory/1856-122-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/1856-123-0x0000000000401000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/1856-124-0x00000000744C0000-0x00000000745B1000-memory.dmpFilesize
964KB