Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2022 17:55
Static task
static1
General
-
Target
6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe
-
Size
249KB
-
MD5
735b318d4a6fb60baec90df8f94116d8
-
SHA1
606bbb8b0dea392f0674db1b07b4a62110ecfb8b
-
SHA256
6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648
-
SHA512
3a8fc76c605731590435e0a1beba7278a176343467e998f678fc0c4c99b19bf3cfe9dc2209ced543dc7cb2a7a417cb72ac6993d6253d90f3e834abe21a733435
-
SSDEEP
6144:D0DxqvNoBzTle27SquPNxW0EvKjeNb7sGnGtaQQQGs4nzRV:4UvOBzTle27Squ3eCj0mVG9tV
Malware Config
Extracted
systembc
146.70.101.80:4001
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
dhuc.exepid process 4276 dhuc.exe -
Drops file in Windows directory 2 IoCs
Processes:
6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exedescription ioc process File created C:\Windows\Tasks\dhuc.job 6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe File opened for modification C:\Windows\Tasks\dhuc.job 6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4076 4192 WerFault.exe 6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exepid process 4192 6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe 4192 6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe"C:\Users\Admin\AppData\Local\Temp\6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 4642⤵
- Program crash
-
C:\ProgramData\wlnsagm\dhuc.exeC:\ProgramData\wlnsagm\dhuc.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4192 -ip 41921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\wlnsagm\dhuc.exeFilesize
249KB
MD5735b318d4a6fb60baec90df8f94116d8
SHA1606bbb8b0dea392f0674db1b07b4a62110ecfb8b
SHA2566f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648
SHA5123a8fc76c605731590435e0a1beba7278a176343467e998f678fc0c4c99b19bf3cfe9dc2209ced543dc7cb2a7a417cb72ac6993d6253d90f3e834abe21a733435
-
C:\ProgramData\wlnsagm\dhuc.exeFilesize
249KB
MD5735b318d4a6fb60baec90df8f94116d8
SHA1606bbb8b0dea392f0674db1b07b4a62110ecfb8b
SHA2566f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648
SHA5123a8fc76c605731590435e0a1beba7278a176343467e998f678fc0c4c99b19bf3cfe9dc2209ced543dc7cb2a7a417cb72ac6993d6253d90f3e834abe21a733435
-
memory/4192-132-0x00000000006E8000-0x00000000006F8000-memory.dmpFilesize
64KB
-
memory/4192-133-0x00000000006B0000-0x00000000006B9000-memory.dmpFilesize
36KB
-
memory/4192-134-0x0000000000400000-0x000000000059B000-memory.dmpFilesize
1.6MB
-
memory/4276-137-0x0000000000843000-0x0000000000853000-memory.dmpFilesize
64KB
-
memory/4276-138-0x0000000000400000-0x000000000059B000-memory.dmpFilesize
1.6MB