Analysis
-
max time kernel
165s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 16:19
Static task
static1
Behavioral task
behavioral1
Sample
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe
Resource
win10-en-20211208
General
-
Target
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe
-
Size
2.3MB
-
MD5
6de0f794e0798e016ae648c0d14e8b8d
-
SHA1
5d7b08a3a4bcf39e7b8f4df472bb76843261dd54
-
SHA256
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017
-
SHA512
c9757ce91ebfd09afdae5928836686bcd0cff556a63fd5cdb3b7e0cab6df7b429aa9cbd678a2152aecf0902e202f429e8d0ddbc01d0b2a835291e50204a5890c
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9083
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
winlogomwindefenders
-
install_file
winlogomwindefender.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1864-128-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1864-129-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1864-130-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogomwindefender = "C:\\Users\\Admin\\AppData\\Local\\winlogomwindefenders\\winlogomwindefender.exe" 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exepid process 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exedescription pid process target process PID 832 set thread context of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exepid process 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious behavior: RenamesItself 16 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exepid process 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exedescription pid process Token: SeDebugPrivilege 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe Token: SeShutdownPrivilege 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exepid process 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1864 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exedescription pid process target process PID 832 wrote to memory of 1736 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1736 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1736 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 2016 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 2016 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 2016 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe PID 832 wrote to memory of 1864 832 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe 1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"C:\Users\Admin\AppData\Local\Temp\1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-118-0x0000000000BD0000-0x0000000000E1A000-memory.dmpFilesize
2.3MB
-
memory/832-119-0x00000000057C0000-0x000000000585C000-memory.dmpFilesize
624KB
-
memory/832-120-0x0000000005D80000-0x000000000627E000-memory.dmpFilesize
5.0MB
-
memory/832-121-0x0000000005880000-0x0000000005912000-memory.dmpFilesize
584KB
-
memory/832-122-0x0000000005880000-0x0000000005D7E000-memory.dmpFilesize
5.0MB
-
memory/832-123-0x0000000005760000-0x000000000576A000-memory.dmpFilesize
40KB
-
memory/832-124-0x0000000005A90000-0x0000000005AE6000-memory.dmpFilesize
344KB
-
memory/832-125-0x0000000005D60000-0x0000000005D78000-memory.dmpFilesize
96KB
-
memory/832-126-0x00000000093C0000-0x00000000095B0000-memory.dmpFilesize
1.9MB
-
memory/832-127-0x000000000CBD0000-0x000000000CD46000-memory.dmpFilesize
1.5MB
-
memory/1864-128-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1864-129-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1864-130-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB