Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19-04-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe
Resource
win7-20220414-en
General
-
Target
af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe
-
Size
253KB
-
MD5
9cd154556bc65d6fe2007074790248f7
-
SHA1
7340996d675919b7212134457b425923eb42563e
-
SHA256
af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd
-
SHA512
e2d55fcd373b5768023638a1e0ad3229710a75034c7acfd0896279ad716a72c1d51bd01710c4baba6be7b6919eb93c251de7632e7d258e95648a878099dd2c3a
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Signatures
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE 1 IoCs
Processes:
eaoftk.exepid process 1172 eaoftk.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip4.seeip.org 8 ip4.seeip.org 5 api.ipify.org 6 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exedescription ioc process File created C:\Windows\Tasks\eaoftk.job af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe File opened for modification C:\Windows\Tasks\eaoftk.job af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exepid process 1492 af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1348 wrote to memory of 1172 1348 taskeng.exe eaoftk.exe PID 1348 wrote to memory of 1172 1348 taskeng.exe eaoftk.exe PID 1348 wrote to memory of 1172 1348 taskeng.exe eaoftk.exe PID 1348 wrote to memory of 1172 1348 taskeng.exe eaoftk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe"C:\Users\Admin\AppData\Local\Temp\af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1492
-
C:\Windows\system32\taskeng.exetaskeng.exe {E54A6AA1-FDEA-4BAC-912C-6C5B11D8A382} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\ProgramData\uicxtj\eaoftk.exeC:\ProgramData\uicxtj\eaoftk.exe start2⤵
- Executes dropped EXE
PID:1172
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\uicxtj\eaoftk.exeFilesize
253KB
MD59cd154556bc65d6fe2007074790248f7
SHA17340996d675919b7212134457b425923eb42563e
SHA256af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd
SHA512e2d55fcd373b5768023638a1e0ad3229710a75034c7acfd0896279ad716a72c1d51bd01710c4baba6be7b6919eb93c251de7632e7d258e95648a878099dd2c3a
-
C:\ProgramData\uicxtj\eaoftk.exeFilesize
253KB
MD59cd154556bc65d6fe2007074790248f7
SHA17340996d675919b7212134457b425923eb42563e
SHA256af35b29f584f06fefbdb9f25bf0dd3679661e449bd3a9e7f282906b27ea517dd
SHA512e2d55fcd373b5768023638a1e0ad3229710a75034c7acfd0896279ad716a72c1d51bd01710c4baba6be7b6919eb93c251de7632e7d258e95648a878099dd2c3a
-
memory/1172-60-0x0000000000000000-mapping.dmp
-
memory/1172-62-0x00000000023D4000-0x00000000023DA000-memory.dmpFilesize
24KB
-
memory/1172-65-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1172-64-0x00000000023D4000-0x00000000023DA000-memory.dmpFilesize
24KB
-
memory/1172-66-0x0000000000400000-0x00000000022FC000-memory.dmpFilesize
31.0MB
-
memory/1492-54-0x0000000002404000-0x000000000240B000-memory.dmpFilesize
28KB
-
memory/1492-55-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1492-56-0x0000000002404000-0x000000000240B000-memory.dmpFilesize
28KB
-
memory/1492-57-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1492-58-0x0000000000400000-0x00000000022FC000-memory.dmpFilesize
31.0MB