Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 10:11
Static task
static1
Behavioral task
behavioral1
Sample
e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe
Resource
win7-20220414-en
General
-
Target
e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe
-
Size
356KB
-
MD5
c851a0d3a2cb3e759e85d73f48437fe1
-
SHA1
3210b9c823d8c1d75f2770884abc1c675db8081b
-
SHA256
e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8
-
SHA512
a3b42489df794cffe8b539199dcfcb18dead5d820c6325f0e75cdd40abe6e67309c6980a8667da6905b0aa6dc000306c8a778ce125c5e4b54f0036e95983a9a0
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hkug.exepid process 1716 hkug.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org 8 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exedescription ioc process File created C:\Windows\Tasks\hkug.job e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe File opened for modification C:\Windows\Tasks\hkug.job e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exepid process 1520 e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 960 wrote to memory of 1716 960 taskeng.exe hkug.exe PID 960 wrote to memory of 1716 960 taskeng.exe hkug.exe PID 960 wrote to memory of 1716 960 taskeng.exe hkug.exe PID 960 wrote to memory of 1716 960 taskeng.exe hkug.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe"C:\Users\Admin\AppData\Local\Temp\e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
C:\Windows\system32\taskeng.exetaskeng.exe {76699236-F41B-471E-AEE6-27221BE7FFA3} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:960 -
C:\ProgramData\jhma\hkug.exeC:\ProgramData\jhma\hkug.exe start2⤵
- Executes dropped EXE
PID:1716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\jhma\hkug.exeFilesize
356KB
MD5c851a0d3a2cb3e759e85d73f48437fe1
SHA13210b9c823d8c1d75f2770884abc1c675db8081b
SHA256e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8
SHA512a3b42489df794cffe8b539199dcfcb18dead5d820c6325f0e75cdd40abe6e67309c6980a8667da6905b0aa6dc000306c8a778ce125c5e4b54f0036e95983a9a0
-
C:\ProgramData\jhma\hkug.exeFilesize
356KB
MD5c851a0d3a2cb3e759e85d73f48437fe1
SHA13210b9c823d8c1d75f2770884abc1c675db8081b
SHA256e813bbd838ee06d2af4c0ac30a87f040f763abc993c6139aa830c37d1a0310e8
SHA512a3b42489df794cffe8b539199dcfcb18dead5d820c6325f0e75cdd40abe6e67309c6980a8667da6905b0aa6dc000306c8a778ce125c5e4b54f0036e95983a9a0
-
memory/1520-54-0x0000000000D69000-0x0000000000D6F000-memory.dmpFilesize
24KB
-
memory/1520-55-0x0000000000D69000-0x0000000000D6F000-memory.dmpFilesize
24KB
-
memory/1520-56-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1520-57-0x0000000076451000-0x0000000076453000-memory.dmpFilesize
8KB
-
memory/1520-58-0x0000000000400000-0x0000000000C33000-memory.dmpFilesize
8.2MB
-
memory/1716-60-0x0000000000000000-mapping.dmp
-
memory/1716-62-0x0000000000D69000-0x0000000000D6F000-memory.dmpFilesize
24KB
-
memory/1716-65-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1716-64-0x0000000000D69000-0x0000000000D6F000-memory.dmpFilesize
24KB
-
memory/1716-66-0x0000000000400000-0x0000000000C33000-memory.dmpFilesize
8.2MB