Analysis
-
max time kernel
201s -
max time network
244s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 11:43
Static task
static1
Behavioral task
behavioral1
Sample
5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
Resource
win7-20220414-en
General
-
Target
5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
-
Size
247KB
-
MD5
aa00750f0df31493289bf07719cefd5e
-
SHA1
3c5b53cea10a28b955d1224ec2d293c639874593
-
SHA256
5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f
-
SHA512
cc679227e4e137885cfbf475e89f5832cbb3009b2e95aba661b6f2c973bc56672480e3c695daca6acf825fafcc8bc7e667ab92eb81da2d1aeb7d66deb55d7704
Malware Config
Extracted
systembc
217.8.117.114:4062
213.159.213.225:4062
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
knwgpa.exepid process 2492 knwgpa.exe -
Drops file in Windows directory 2 IoCs
Processes:
5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exedescription ioc process File created C:\Windows\Tasks\knwgpa.job 5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe File opened for modification C:\Windows\Tasks\knwgpa.job 5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exepid process 4816 5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe 4816 5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe"C:\Users\Admin\AppData\Local\Temp\5c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\lmxc\knwgpa.exeC:\ProgramData\lmxc\knwgpa.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\lmxc\knwgpa.exeFilesize
247KB
MD5aa00750f0df31493289bf07719cefd5e
SHA13c5b53cea10a28b955d1224ec2d293c639874593
SHA2565c947115e5de28bf753bdf423b76cec09ab76f339c62058392b603391cbf461f
SHA512cc679227e4e137885cfbf475e89f5832cbb3009b2e95aba661b6f2c973bc56672480e3c695daca6acf825fafcc8bc7e667ab92eb81da2d1aeb7d66deb55d7704
-
memory/2492-136-0x00000000009F0000-0x0000000000A00000-memory.dmpFilesize
64KB
-
memory/2492-137-0x0000000077060000-0x0000000077203000-memory.dmpFilesize
1.6MB
-
memory/2492-138-0x0000000077060000-0x0000000077203000-memory.dmpFilesize
1.6MB
-
memory/2492-139-0x00000000012D0000-0x00000000012DB000-memory.dmpFilesize
44KB
-
memory/4816-131-0x0000000000C90000-0x0000000000CA0000-memory.dmpFilesize
64KB
-
memory/4816-132-0x0000000077060000-0x0000000077203000-memory.dmpFilesize
1.6MB
-
memory/4816-133-0x0000000077060000-0x0000000077203000-memory.dmpFilesize
1.6MB
-
memory/4816-134-0x0000000000D20000-0x0000000000D2B000-memory.dmpFilesize
44KB