Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2022 08:13
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
172KB
-
MD5
9f48a667f96c0cd55c6f6acd68976563
-
SHA1
87622ba459b912a040a3919cf5e4d4c6af7ff8dc
-
SHA256
d9cd94b48ccedbd006ec0c6c3d24f0fe18fa60d7a20f90408acbc3617d37126b
-
SHA512
1d804bcb07119118fed8a66a262dadab876ce5f09bc6d461159953d8edfe2da8659ec1fe0cfe7f112f17dba91cc7bb90863d66175be3df2841e098f4f75bb1ca
-
SSDEEP
3072:02g2ZW/HNmPagkh3DDptrONvMDn4lPdKvqVpB/Jmtk9cuvI:x8vCehzDnrDudKva/cic
Malware Config
Extracted
Family
systembc
C2
193.106.191.168:4244
146.70.53.169:4244
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
tmp.exedescription ioc process File created C:\Windows\Tasks\wow64.job tmp.exe File opened for modification C:\Windows\Tasks\wow64.job tmp.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5060 1720 WerFault.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 4722⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe start1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1720 -ip 17201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-136-0x00000000025C0000-0x00000000025C5000-memory.dmpFilesize
20KB
-
memory/316-135-0x00000000025EF000-0x00000000025FF000-memory.dmpFilesize
64KB
-
memory/316-137-0x0000000000400000-0x00000000024AE000-memory.dmpFilesize
32.7MB
-
memory/316-139-0x00000000025EF000-0x00000000025FF000-memory.dmpFilesize
64KB
-
memory/1720-132-0x000000000278D000-0x000000000279D000-memory.dmpFilesize
64KB
-
memory/1720-133-0x0000000002740000-0x0000000002745000-memory.dmpFilesize
20KB
-
memory/1720-134-0x0000000000400000-0x00000000024AE000-memory.dmpFilesize
32.7MB
-
memory/1720-138-0x000000000278D000-0x000000000279D000-memory.dmpFilesize
64KB