Analysis
-
max time kernel
4294205s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
16-03-2022 21:33
Static task
static1
Behavioral task
behavioral1
Sample
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe
Resource
win10v2004-en-20220113
General
-
Target
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe
-
Size
2.5MB
-
MD5
9ef46e52f374eb55fcf8e8b56ade936a
-
SHA1
c103471fe52a01b9d0ab1f13f792354fa72f3c1f
-
SHA256
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601
-
SHA512
56b96960b1d2af40eea1f75ffdbd5e34f900dc709d820f8b441600850a6310c167c4d2411b38facc49a698afbfb369da6d71682b87397204a4ae917b495629d0
Malware Config
Extracted
bitrat
1.32
u868328.nvpn.to:5881
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exepid process 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exedescription pid process target process PID 628 set thread context of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exepid process 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exec07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exedescription pid process Token: SeDebugPrivilege 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe Token: SeDebugPrivilege 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe Token: SeShutdownPrivilege 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exepid process 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe 1152 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exedescription pid process target process PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe PID 628 wrote to memory of 1152 628 c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe"C:\Users\Admin\AppData\Local\Temp\c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe"C:\Users\Admin\AppData\Local\Temp\c07aa4fafc217761b33693471a1dad5d77d57cedd5e4511dd9ad868fc4921601.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-54-0x0000000075B01000-0x0000000075B03000-memory.dmpFilesize
8KB
-
memory/628-56-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/628-55-0x0000000074E20000-0x00000000753CB000-memory.dmpFilesize
5.7MB
-
memory/628-57-0x0000000074E20000-0x00000000753CB000-memory.dmpFilesize
5.7MB
-
memory/1152-58-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-60-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-62-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-64-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-66-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-68-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-70-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB
-
memory/1152-72-0x0000000000400000-0x00000000007AC000-memory.dmpFilesize
3.7MB