Analysis
-
max time kernel
105s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-04-2022 15:58
Static task
static1
Behavioral task
behavioral1
Sample
29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe
Resource
win7-20220414-en
General
-
Target
29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe
-
Size
267KB
-
MD5
96b1c3d8279ef00b1b8b1e2c4bc64d77
-
SHA1
d9cece2958797a7fe2895ef9fe9ebdb80717de73
-
SHA256
29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a
-
SHA512
120778338d6507742dfdf3a911f9c7de509bab853cf6c0332cd936c8ec0bb469e5c26fc1dda4768e66d09f6eadcbd98713efea26c49a35c433a5642e27f79127
Malware Config
Extracted
systembc
advertrex20.xyz:4044
gentexman37.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pjle.exepid process 1756 pjle.exe -
Drops file in Windows directory 2 IoCs
Processes:
29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exedescription ioc process File created C:\Windows\Tasks\pjle.job 29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe File opened for modification C:\Windows\Tasks\pjle.job 29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exepid process 1608 29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1908 wrote to memory of 1756 1908 taskeng.exe pjle.exe PID 1908 wrote to memory of 1756 1908 taskeng.exe pjle.exe PID 1908 wrote to memory of 1756 1908 taskeng.exe pjle.exe PID 1908 wrote to memory of 1756 1908 taskeng.exe pjle.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe"C:\Users\Admin\AppData\Local\Temp\29419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {55F80D73-0244-43BB-A4E8-AE151A0DBA69} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\fdxlwju\pjle.exeC:\ProgramData\fdxlwju\pjle.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\fdxlwju\pjle.exeFilesize
267KB
MD596b1c3d8279ef00b1b8b1e2c4bc64d77
SHA1d9cece2958797a7fe2895ef9fe9ebdb80717de73
SHA25629419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a
SHA512120778338d6507742dfdf3a911f9c7de509bab853cf6c0332cd936c8ec0bb469e5c26fc1dda4768e66d09f6eadcbd98713efea26c49a35c433a5642e27f79127
-
C:\ProgramData\fdxlwju\pjle.exeFilesize
267KB
MD596b1c3d8279ef00b1b8b1e2c4bc64d77
SHA1d9cece2958797a7fe2895ef9fe9ebdb80717de73
SHA25629419e77b22185d288de119f4a415e5f5aebdd8034ab2fa5afbbca3b6866b20a
SHA512120778338d6507742dfdf3a911f9c7de509bab853cf6c0332cd936c8ec0bb469e5c26fc1dda4768e66d09f6eadcbd98713efea26c49a35c433a5642e27f79127
-
memory/1608-54-0x0000000076C01000-0x0000000076C03000-memory.dmpFilesize
8KB
-
memory/1608-55-0x0000000000020000-0x0000000000026000-memory.dmpFilesize
24KB
-
memory/1608-56-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1608-57-0x0000000000400000-0x00000000004D3000-memory.dmpFilesize
844KB
-
memory/1756-59-0x0000000000000000-mapping.dmp