Analysis
-
max time kernel
61s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 07:31
Static task
static1
Behavioral task
behavioral1
Sample
c65326b66f8e1799d3b4b62ced8431ad.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
c65326b66f8e1799d3b4b62ced8431ad.exe
-
Size
946KB
-
MD5
c65326b66f8e1799d3b4b62ced8431ad
-
SHA1
2435632e756173e92a1f14e10573bdc32895a6c5
-
SHA256
c72ce273124fce08bf9dd61845a78651d7ba402f9164f117f4d6d0ad5d0212ba
-
SHA512
034b09c7f3bd8b2dba0f3aad38d96db03d9c23c09b36653014716088c5829b40d1255c0b7c8880d9ec19a342132be2ddbac88c6b4bcea31c44643370f40300a1
Malware Config
Extracted
Family
systembc
C2
135.125.248.50:443
146.70.53.169:443
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
c65326b66f8e1799d3b4b62ced8431ad.exedescription ioc process File created C:\Windows\Tasks\wow64.job c65326b66f8e1799d3b4b62ced8431ad.exe File opened for modification C:\Windows\Tasks\wow64.job c65326b66f8e1799d3b4b62ced8431ad.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 992 wrote to memory of 1636 992 taskeng.exe c65326b66f8e1799d3b4b62ced8431ad.exe PID 992 wrote to memory of 1636 992 taskeng.exe c65326b66f8e1799d3b4b62ced8431ad.exe PID 992 wrote to memory of 1636 992 taskeng.exe c65326b66f8e1799d3b4b62ced8431ad.exe PID 992 wrote to memory of 1636 992 taskeng.exe c65326b66f8e1799d3b4b62ced8431ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe"C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {A7016F27-5C55-4949-BAD2-1E658EB2803F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exeC:\Users\Admin\AppData\Local\Temp\c65326b66f8e1799d3b4b62ced8431ad.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-57-0x0000000000000000-mapping.dmp
-
memory/1636-59-0x0000000000400000-0x00000000004F4000-memory.dmpFilesize
976KB
-
memory/1968-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1968-55-0x00000000002D0000-0x00000000002D5000-memory.dmpFilesize
20KB
-
memory/1968-56-0x0000000000400000-0x00000000004F4000-memory.dmpFilesize
976KB