Analysis
-
max time kernel
188s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 17:50
Static task
static1
Behavioral task
behavioral1
Sample
c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe
Resource
win7-20220414-en
General
-
Target
c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe
-
Size
96KB
-
MD5
a04c8b219c9cc54437b337b0f9efbf9b
-
SHA1
2f8c91d4074917f25be71102344d8415aa2b1756
-
SHA256
c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a
-
SHA512
0baf265384b689f2414b10e6628a5c84fae66728618954784944e176e202eff988a20f9e1fcb35b44f3df23c87dcbdddad9485d1d97975ff4f1515e8e547ac6b
Malware Config
Extracted
systembc
23hfdne.com:4035
23hfdne.xyz:4035
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
akmtlc.exepid process 1732 akmtlc.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org 8 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exedescription ioc process File created C:\Windows\Tasks\akmtlc.job c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe File opened for modification C:\Windows\Tasks\akmtlc.job c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exepid process 1928 c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 2028 wrote to memory of 1732 2028 taskeng.exe akmtlc.exe PID 2028 wrote to memory of 1732 2028 taskeng.exe akmtlc.exe PID 2028 wrote to memory of 1732 2028 taskeng.exe akmtlc.exe PID 2028 wrote to memory of 1732 2028 taskeng.exe akmtlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe"C:\Users\Admin\AppData\Local\Temp\c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
C:\Windows\system32\taskeng.exetaskeng.exe {A56BFCCC-D31A-44CB-BE24-DE036B546AB5} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\ProgramData\erwdtj\akmtlc.exeC:\ProgramData\erwdtj\akmtlc.exe start2⤵
- Executes dropped EXE
PID:1732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\erwdtj\akmtlc.exeFilesize
96KB
MD5a04c8b219c9cc54437b337b0f9efbf9b
SHA12f8c91d4074917f25be71102344d8415aa2b1756
SHA256c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a
SHA5120baf265384b689f2414b10e6628a5c84fae66728618954784944e176e202eff988a20f9e1fcb35b44f3df23c87dcbdddad9485d1d97975ff4f1515e8e547ac6b
-
C:\ProgramData\erwdtj\akmtlc.exeFilesize
96KB
MD5a04c8b219c9cc54437b337b0f9efbf9b
SHA12f8c91d4074917f25be71102344d8415aa2b1756
SHA256c51cf33451f5667a1a5ff3790cfe930580f00cbccbc8c7d19876c1048deed18a
SHA5120baf265384b689f2414b10e6628a5c84fae66728618954784944e176e202eff988a20f9e1fcb35b44f3df23c87dcbdddad9485d1d97975ff4f1515e8e547ac6b
-
memory/1732-60-0x0000000000000000-mapping.dmp
-
memory/1732-62-0x000000000093B000-0x0000000000942000-memory.dmpFilesize
28KB
-
memory/1732-64-0x000000000093B000-0x0000000000942000-memory.dmpFilesize
28KB
-
memory/1732-65-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/1928-54-0x00000000005BB000-0x00000000005C2000-memory.dmpFilesize
28KB
-
memory/1928-55-0x0000000075941000-0x0000000075943000-memory.dmpFilesize
8KB
-
memory/1928-56-0x00000000005BB000-0x00000000005C2000-memory.dmpFilesize
28KB
-
memory/1928-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1928-58-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB