Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe
Resource
win7-20220414-en
General
-
Target
b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe
-
Size
89KB
-
MD5
ef794afbd770b7ee3c8a9ccffb9810fe
-
SHA1
1bc62eeef9f672fbde7df2de77b15b25dbc87610
-
SHA256
b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816
-
SHA512
bc2539be88630e38ebbf27ee603c666815be68f3a45a0b8c04e2df59c77fba094f71f5e1f40789ac558201e7a183b63a379526848cfb35ea724464ee3436d47d
Malware Config
Extracted
systembc
23hfdne.com:4035
23hfdne.xyz:4035
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sdixqkl.exepid process 1636 sdixqkl.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org 6 ip4.seeip.org 7 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exedescription ioc process File created C:\Windows\Tasks\sdixqkl.job b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe File opened for modification C:\Windows\Tasks\sdixqkl.job b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exepid process 1720 b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 956 wrote to memory of 1636 956 taskeng.exe sdixqkl.exe PID 956 wrote to memory of 1636 956 taskeng.exe sdixqkl.exe PID 956 wrote to memory of 1636 956 taskeng.exe sdixqkl.exe PID 956 wrote to memory of 1636 956 taskeng.exe sdixqkl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe"C:\Users\Admin\AppData\Local\Temp\b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
C:\Windows\system32\taskeng.exetaskeng.exe {BF5D225C-087D-4604-851F-43FDAC6B4977} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\ProgramData\nndor\sdixqkl.exeC:\ProgramData\nndor\sdixqkl.exe start2⤵
- Executes dropped EXE
PID:1636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\nndor\sdixqkl.exeFilesize
89KB
MD5ef794afbd770b7ee3c8a9ccffb9810fe
SHA11bc62eeef9f672fbde7df2de77b15b25dbc87610
SHA256b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816
SHA512bc2539be88630e38ebbf27ee603c666815be68f3a45a0b8c04e2df59c77fba094f71f5e1f40789ac558201e7a183b63a379526848cfb35ea724464ee3436d47d
-
C:\ProgramData\nndor\sdixqkl.exeFilesize
89KB
MD5ef794afbd770b7ee3c8a9ccffb9810fe
SHA11bc62eeef9f672fbde7df2de77b15b25dbc87610
SHA256b2fddc79dd5fbe683e9b8737304494e5b5ebf993382714f3a27c045cb3d7f816
SHA512bc2539be88630e38ebbf27ee603c666815be68f3a45a0b8c04e2df59c77fba094f71f5e1f40789ac558201e7a183b63a379526848cfb35ea724464ee3436d47d
-
memory/1636-60-0x0000000000000000-mapping.dmp
-
memory/1636-62-0x00000000005CB000-0x00000000005D2000-memory.dmpFilesize
28KB
-
memory/1636-64-0x00000000005CB000-0x00000000005D2000-memory.dmpFilesize
28KB
-
memory/1636-65-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/1720-54-0x00000000006CB000-0x00000000006D2000-memory.dmpFilesize
28KB
-
memory/1720-55-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1720-56-0x00000000006CB000-0x00000000006D2000-memory.dmpFilesize
28KB
-
memory/1720-57-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1720-58-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB