Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 20:14
Static task
static1
Behavioral task
behavioral1
Sample
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe
Resource
win10v2004-20220414-en
General
-
Target
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe
-
Size
3.8MB
-
MD5
fa0ed279049035b9019eb20e1d0804e1
-
SHA1
f8323bf5d5e5c63a26f65067954ba6fdbdb13f60
-
SHA256
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8
-
SHA512
a19c621957550e1aa10e2e57596fb7f3f63aea8846a9e6d3744c5ba6a2268a32ac12acdc50bfc5fa16d5ac263fac298d78a72c5211746bc3aee55681e4a9dbde
Malware Config
Extracted
bitrat
1.35
jamjamp22-45642.portmap.host:45642
-
communication_password
1e553be118546a9eae0f52103e13514f
-
install_dir
svchost
-
install_file
svchost.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost\\svchost.exe" 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exepid process 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exepid process 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exedescription pid process Token: SeDebugPrivilege 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe Token: SeShutdownPrivilege 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exepid process 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe 2044 44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe"C:\Users\Admin\AppData\Local\Temp\44390430ef06d4c526cb24433728cae0a9d72897d5740b17f6adfb1f1178ddb8.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx