Analysis
-
max time kernel
91s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 17:02
Static task
static1
General
-
Target
ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe
-
Size
329KB
-
MD5
5a97df322aaa1061de7186b345a03a85
-
SHA1
1aa1df1b086e92c4d29435de5ec20897e531f862
-
SHA256
ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
-
SHA512
22e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
SSDEEP
6144:I14NEbc/Gdhg2ZTPI/aXw/jDY0k2Aq8RNnigabwVfs:I142c/qhg2xPI/ag/jhkHq2NiB
Malware Config
Extracted
systembc
141.98.82.229:4001
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ibielp.exepid process 384 ibielp.exe -
Drops file in Windows directory 2 IoCs
Processes:
ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exedescription ioc process File created C:\Windows\Tasks\ibielp.job ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe File opened for modification C:\Windows\Tasks\ibielp.job ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1280 4660 WerFault.exe ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exepid process 4660 ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe 4660 ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe"C:\Users\Admin\AppData\Local\Temp\ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 4762⤵
- Program crash
-
C:\ProgramData\bwdk\ibielp.exeC:\ProgramData\bwdk\ibielp.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4660 -ip 46601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\bwdk\ibielp.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\ProgramData\bwdk\ibielp.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
memory/384-139-0x00000000005CA000-0x00000000005DA000-memory.dmpFilesize
64KB
-
memory/384-140-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4660-132-0x000000000065E000-0x000000000066F000-memory.dmpFilesize
68KB
-
memory/4660-133-0x0000000000630000-0x0000000000639000-memory.dmpFilesize
36KB
-
memory/4660-134-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4660-135-0x000000000065E000-0x000000000066F000-memory.dmpFilesize
68KB
-
memory/4660-136-0x0000000000630000-0x0000000000639000-memory.dmpFilesize
36KB
-
memory/4660-141-0x000000000065E000-0x000000000066F000-memory.dmpFilesize
68KB