Analysis
-
max time kernel
72s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 12:25
Static task
static1
General
-
Target
6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe
-
Size
153KB
-
MD5
a20d99e025fb23ba51d38a975bc10de5
-
SHA1
6d58a7dc6f4e84ed6cf70fb154e6af3193ff4045
-
SHA256
6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59
-
SHA512
a99ea0bc3d947e5048d92f8e5bdf1745c5d428f2934e29cb2d4f7d3bea029a467e01f28fdc5f09390141b80ad80e016b5b9171fb3b4bf2bd0e0a84a6d9328198
-
SSDEEP
3072:lbUHG5euMB5Y7S8TmACM+nhICbBUw3r5x:0uqYe8qAbCTz
Malware Config
Extracted
systembc
141.98.82.229:4001
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
wkdwn.exepid process 1256 wkdwn.exe -
Drops file in Windows directory 2 IoCs
Processes:
6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exedescription ioc process File opened for modification C:\Windows\Tasks\wkdwn.job 6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe File created C:\Windows\Tasks\wkdwn.job 6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3740 2812 WerFault.exe 6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exepid process 2812 6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe 2812 6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe"C:\Users\Admin\AppData\Local\Temp\6278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 9402⤵
- Program crash
-
C:\ProgramData\hqeovmt\wkdwn.exeC:\ProgramData\hqeovmt\wkdwn.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2812 -ip 28121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hqeovmt\wkdwn.exeFilesize
153KB
MD5a20d99e025fb23ba51d38a975bc10de5
SHA16d58a7dc6f4e84ed6cf70fb154e6af3193ff4045
SHA2566278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59
SHA512a99ea0bc3d947e5048d92f8e5bdf1745c5d428f2934e29cb2d4f7d3bea029a467e01f28fdc5f09390141b80ad80e016b5b9171fb3b4bf2bd0e0a84a6d9328198
-
C:\ProgramData\hqeovmt\wkdwn.exeFilesize
153KB
MD5a20d99e025fb23ba51d38a975bc10de5
SHA16d58a7dc6f4e84ed6cf70fb154e6af3193ff4045
SHA2566278b1a4d8a19c7ac40ee309c100924427fb35028f3eadb96112c9b70c3a0d59
SHA512a99ea0bc3d947e5048d92f8e5bdf1745c5d428f2934e29cb2d4f7d3bea029a467e01f28fdc5f09390141b80ad80e016b5b9171fb3b4bf2bd0e0a84a6d9328198
-
memory/1256-137-0x0000000000923000-0x0000000000933000-memory.dmpFilesize
64KB
-
memory/1256-138-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/2812-132-0x0000000000628000-0x0000000000639000-memory.dmpFilesize
68KB
-
memory/2812-133-0x0000000000600000-0x0000000000609000-memory.dmpFilesize
36KB
-
memory/2812-134-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/2812-139-0x0000000000628000-0x0000000000639000-memory.dmpFilesize
68KB