Analysis
-
max time kernel
163s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
26-03-2022 00:38
Static task
static1
Behavioral task
behavioral1
Sample
b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe
Resource
win7-20220311-en
General
-
Target
b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe
-
Size
285KB
-
MD5
44104370647086089833d115c55f6d7f
-
SHA1
502c3678a36c7433bc402f787cc0f0c7cc7eec29
-
SHA256
b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e
-
SHA512
a91ca5aa9dfa02f35ef2344b3485e28ab55f41fc4d0f38a9d176b959e10cbfdba8a79b304d67ec3e1478ed9270e3e79855bd352a932e3845e8141ac471b2b29e
Malware Config
Extracted
systembc
advertrex20.xyz:4044
gentexman37.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
limaxgj.exepid process 3836 limaxgj.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.ipify.org 35 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exedescription ioc process File created C:\Windows\Tasks\limaxgj.job b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe File opened for modification C:\Windows\Tasks\limaxgj.job b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1792 3764 WerFault.exe b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exepid process 3764 b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe 3764 b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe"C:\Users\Admin\AppData\Local\Temp\b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 4842⤵
- Program crash
PID:1792
-
-
C:\ProgramData\cauvd\limaxgj.exeC:\ProgramData\cauvd\limaxgj.exe start1⤵
- Executes dropped EXE
PID:3836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3764 -ip 37641⤵PID:2516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
44104370647086089833d115c55f6d7f
SHA1502c3678a36c7433bc402f787cc0f0c7cc7eec29
SHA256b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e
SHA512a91ca5aa9dfa02f35ef2344b3485e28ab55f41fc4d0f38a9d176b959e10cbfdba8a79b304d67ec3e1478ed9270e3e79855bd352a932e3845e8141ac471b2b29e
-
MD5
44104370647086089833d115c55f6d7f
SHA1502c3678a36c7433bc402f787cc0f0c7cc7eec29
SHA256b87961b51b3b2958a9b2a0dd6e0f56edb0efb52fdcc68aa553097c2ea5f52e4e
SHA512a91ca5aa9dfa02f35ef2344b3485e28ab55f41fc4d0f38a9d176b959e10cbfdba8a79b304d67ec3e1478ed9270e3e79855bd352a932e3845e8141ac471b2b29e