Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
31-05-2022 06:12
Static task
static1
Behavioral task
behavioral1
Sample
0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe
-
Size
507KB
-
MD5
e38d0d5ef1f8dd657479d08248dd83a1
-
SHA1
85df1e4f362b0bd9f48016b7f155aa757f7bc1d7
-
SHA256
0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69
-
SHA512
212d9a356406bacc8f8f388b195fd22fcf02757da5543e7a5f5d66d09b84ee310a9359cf8f979ee0923889862b48ba1ed02fb60fea0b4bd3486a930f4a3d690b
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exepid process 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exepid process 2360 0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe"C:\Users\Admin\AppData\Local\Temp\0664c46691135a3d6015354e0f0c54fd09fed20ab5b8b2582c799dfe35d2dd69.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-130-0x0000000000660000-0x00000000006B3000-memory.dmpFilesize
332KB
-
memory/2360-131-0x0000000000400000-0x0000000000485000-memory.dmpFilesize
532KB
-
memory/2360-133-0x0000000000600000-0x0000000000605000-memory.dmpFilesize
20KB
-
memory/2360-132-0x00000000021C0000-0x0000000002265000-memory.dmpFilesize
660KB