Analysis
-
max time kernel
113s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 16:02
Static task
static1
Behavioral task
behavioral1
Sample
57eb1430903457db36a36023304f8a38.exe
Resource
win7-20220901-en
General
-
Target
57eb1430903457db36a36023304f8a38.exe
-
Size
197KB
-
MD5
57eb1430903457db36a36023304f8a38
-
SHA1
831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
-
SHA256
1962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
-
SHA512
a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
SSDEEP
3072:L6oyUN8LiJ4Ut3Fec85snm3HlR0zMgilHB9tEOzOGI8pJ/CB9XB/PkF4x:LXoLilt3FeKm1RgMrlHB92O+8pu
Malware Config
Extracted
systembc
109.107.187.226:4001
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
lkera.exelkera.exepid process 568 lkera.exe 1056 lkera.exe -
Drops file in Windows directory 2 IoCs
Processes:
57eb1430903457db36a36023304f8a38.exedescription ioc process File created C:\Windows\Tasks\lkera.job 57eb1430903457db36a36023304f8a38.exe File opened for modification C:\Windows\Tasks\lkera.job 57eb1430903457db36a36023304f8a38.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
57eb1430903457db36a36023304f8a38.exepid process 1448 57eb1430903457db36a36023304f8a38.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exedescription pid process target process PID 820 wrote to memory of 568 820 taskeng.exe lkera.exe PID 820 wrote to memory of 568 820 taskeng.exe lkera.exe PID 820 wrote to memory of 568 820 taskeng.exe lkera.exe PID 820 wrote to memory of 568 820 taskeng.exe lkera.exe PID 820 wrote to memory of 1056 820 taskeng.exe lkera.exe PID 820 wrote to memory of 1056 820 taskeng.exe lkera.exe PID 820 wrote to memory of 1056 820 taskeng.exe lkera.exe PID 820 wrote to memory of 1056 820 taskeng.exe lkera.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57eb1430903457db36a36023304f8a38.exe"C:\Users\Admin\AppData\Local\Temp\57eb1430903457db36a36023304f8a38.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {EBB2E118-A404-418C-83F0-979BCDFA14DF} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ipvqwea\lkera.exeC:\ProgramData\ipvqwea\lkera.exe start22⤵
- Executes dropped EXE
-
C:\ProgramData\ipvqwea\lkera.exeC:\ProgramData\ipvqwea\lkera.exe start22⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ipvqwea\lkera.exeFilesize
197KB
MD557eb1430903457db36a36023304f8a38
SHA1831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
SHA2561962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
SHA512a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
C:\ProgramData\ipvqwea\lkera.exeFilesize
197KB
MD557eb1430903457db36a36023304f8a38
SHA1831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
SHA2561962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
SHA512a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
C:\ProgramData\ipvqwea\lkera.exeFilesize
197KB
MD557eb1430903457db36a36023304f8a38
SHA1831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
SHA2561962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
SHA512a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
memory/568-63-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/568-59-0x0000000000000000-mapping.dmp
-
memory/568-62-0x000000000065B000-0x000000000066C000-memory.dmpFilesize
68KB
-
memory/568-66-0x000000000065B000-0x000000000066C000-memory.dmpFilesize
68KB
-
memory/1056-67-0x0000000000000000-mapping.dmp
-
memory/1056-70-0x00000000002CB000-0x00000000002DC000-memory.dmpFilesize
68KB
-
memory/1056-71-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1448-57-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1448-55-0x000000000026B000-0x000000000027C000-memory.dmpFilesize
68KB
-
memory/1448-54-0x00000000758B1000-0x00000000758B3000-memory.dmpFilesize
8KB
-
memory/1448-64-0x000000000026B000-0x000000000027C000-memory.dmpFilesize
68KB
-
memory/1448-65-0x000000000026B000-0x000000000027C000-memory.dmpFilesize
68KB
-
memory/1448-56-0x00000000001B0000-0x00000000001B5000-memory.dmpFilesize
20KB