Resubmissions
16-05-2022 16:24
220516-twn54sddfp 10Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 16:24
Static task
static1
Behavioral task
behavioral1
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win7-20220414-en
General
-
Target
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
-
Size
222KB
-
MD5
72cfa33b978294103889481feca472f2
-
SHA1
0615eb31fd67345b9fa0d57d12a3bcb363152abe
-
SHA256
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
-
SHA512
d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
Malware Config
Extracted
systembc
fanstat18.club:4044
dexblog90.club:4044
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
jist.exejist.exepid process 1552 jist.exe 1572 jist.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 70 api.ipify.org -
Drops file in Windows directory 2 IoCs
Processes:
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exedescription ioc process File created C:\Windows\Tasks\jist.job 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe File opened for modification C:\Windows\Tasks\jist.job 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1176 1388 WerFault.exe 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe 4496 1552 WerFault.exe jist.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exepid process 1388 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe 1388 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe"C:\Users\Admin\AppData\Local\Temp\5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 9482⤵
- Program crash
-
C:\ProgramData\igjq\jist.exeC:\ProgramData\igjq\jist.exe start21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 2562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1388 -ip 13881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1552 -ip 15521⤵
-
C:\ProgramData\igjq\jist.exeC:\ProgramData\igjq\jist.exe start21⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\igjq\jist.exeFilesize
222KB
MD572cfa33b978294103889481feca472f2
SHA10615eb31fd67345b9fa0d57d12a3bcb363152abe
SHA2565d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
SHA512d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
C:\ProgramData\igjq\jist.exeFilesize
222KB
MD572cfa33b978294103889481feca472f2
SHA10615eb31fd67345b9fa0d57d12a3bcb363152abe
SHA2565d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
SHA512d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
C:\ProgramData\igjq\jist.exeFilesize
222KB
MD572cfa33b978294103889481feca472f2
SHA10615eb31fd67345b9fa0d57d12a3bcb363152abe
SHA2565d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
SHA512d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
memory/1388-130-0x0000000000558000-0x000000000055F000-memory.dmpFilesize
28KB
-
memory/1388-131-0x0000000002200000-0x0000000002209000-memory.dmpFilesize
36KB
-
memory/1388-132-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1552-135-0x00000000005D8000-0x00000000005DE000-memory.dmpFilesize
24KB
-
memory/1552-137-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1552-136-0x0000000000550000-0x0000000000559000-memory.dmpFilesize
36KB
-
memory/1572-139-0x00000000005DC000-0x00000000005E2000-memory.dmpFilesize
24KB
-
memory/1572-140-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB