Analysis
-
max time kernel
163s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:11
Static task
static1
Behavioral task
behavioral1
Sample
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe
Resource
win10-en-20211208
General
-
Target
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe
-
Size
2.2MB
-
MD5
d5dfbab804a95d9b8c13446b82ea7189
-
SHA1
add3d4f5db237bdad70d4251c47dee6fde16b340
-
SHA256
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4
-
SHA512
44da065a5bcef77f3322d289f287ce82f46e5c4f8721be23a7b24624828677e26b17714e155a247d33aed3a00c9c2ef52f786f366f62d528aa323697502ddb8e
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9083
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
windefederwinlgomsystems
-
install_file
windefederwinlgomsystem.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3972-128-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3972-129-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3972-130-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefederwinlgomsystem = "C:\\Users\\Admin\\AppData\\Local\\windefederwinlgomsystems\\windefederwinlgomsystem.exeጀ" c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefederwinlgomsystem = "C:\\Users\\Admin\\AppData\\Local\\windefederwinlgomsystems\\windefederwinlgomsystem.exe츀" c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefederwinlgomsystem = "C:\\Users\\Admin\\AppData\\Local\\windefederwinlgomsystems\\windefederwinlgomsystem.exe\uff00" c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefederwinlgomsystem = "C:\\Users\\Admin\\AppData\\Local\\windefederwinlgomsystems\\windefederwinlgomsystem.exeࠀ" c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefederwinlgomsystem = "C:\\Users\\Admin\\AppData\\Local\\windefederwinlgomsystems\\windefederwinlgomsystem.exe" c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\windefederwinlgomsystem = "C:\\Users\\Admin\\AppData\\Local\\windefederwinlgomsystems\\windefederwinlgomsystem.exe케" c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exepid process 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exedescription pid process target process PID 2696 set thread context of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exepid process 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious behavior: RenamesItself 11 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exepid process 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exec51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exedescription pid process Token: SeDebugPrivilege 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe Token: SeShutdownPrivilege 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exepid process 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe 3972 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exedescription pid process target process PID 2696 wrote to memory of 524 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 524 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 524 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe PID 2696 wrote to memory of 3972 2696 c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe"C:\Users\Admin\AppData\Local\Temp\c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe"C:\Users\Admin\AppData\Local\Temp\c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe"C:\Users\Admin\AppData\Local\Temp\c51eb36467745e100f4cc6eebc46c31e1a3a3f02f50da6c562975821b544acf4.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2696-118-0x0000000000620000-0x0000000000852000-memory.dmpFilesize
2.2MB
-
memory/2696-119-0x00000000051F0000-0x000000000528C000-memory.dmpFilesize
624KB
-
memory/2696-120-0x0000000005790000-0x0000000005C8E000-memory.dmpFilesize
5.0MB
-
memory/2696-121-0x0000000005290000-0x0000000005322000-memory.dmpFilesize
584KB
-
memory/2696-122-0x0000000005290000-0x000000000578E000-memory.dmpFilesize
5.0MB
-
memory/2696-123-0x00000000051A0000-0x00000000051AA000-memory.dmpFilesize
40KB
-
memory/2696-124-0x0000000005460000-0x00000000054B6000-memory.dmpFilesize
344KB
-
memory/2696-125-0x0000000007710000-0x0000000007726000-memory.dmpFilesize
88KB
-
memory/2696-126-0x0000000007DA0000-0x0000000007F90000-memory.dmpFilesize
1.9MB
-
memory/2696-127-0x000000000B500000-0x000000000B678000-memory.dmpFilesize
1.5MB
-
memory/3972-128-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3972-129-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3972-130-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB