Analysis
-
max time kernel
157s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08/11/2022, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe
Resource
win7-20220812-en
General
-
Target
a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe
-
Size
2.2MB
-
MD5
8cea9bc30046ce76a8d9d211206b9197
-
SHA1
408b79f4b244be9e288efe7185dc915aaf4a9cbc
-
SHA256
a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6
-
SHA512
95d2b4117ec60f1b0d1611e742da358d77e1488a66e5f87105bb0b1e71ba016e3e153769d51701a47bd8ca85ada38150ee50e7edfc77e1a352a867399d27dcae
-
SSDEEP
24576:gUHmsocCmYbx4wLMR+OXY0WvY0WvY0WvY0WvY0WvY0WvY0WvY0WPY0WvY0WvY0WI:xGkYbx4wLMR+d7c
Malware Config
Extracted
systembc
spexblog17.xyz:4044
admstat45.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1704 nuiwtb.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\nuiwtb.job a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe File created C:\Windows\Tasks\nuiwtb.job a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 972 a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1704 1104 taskeng.exe 29 PID 1104 wrote to memory of 1704 1104 taskeng.exe 29 PID 1104 wrote to memory of 1704 1104 taskeng.exe 29 PID 1104 wrote to memory of 1704 1104 taskeng.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe"C:\Users\Admin\AppData\Local\Temp\a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:972
-
C:\Windows\system32\taskeng.exetaskeng.exe {88809D1D-C630-4D2A-A40F-2A0909C1EEBE} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\ProgramData\qgvtkr\nuiwtb.exeC:\ProgramData\qgvtkr\nuiwtb.exe start22⤵
- Executes dropped EXE
PID:1704
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD58cea9bc30046ce76a8d9d211206b9197
SHA1408b79f4b244be9e288efe7185dc915aaf4a9cbc
SHA256a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6
SHA51295d2b4117ec60f1b0d1611e742da358d77e1488a66e5f87105bb0b1e71ba016e3e153769d51701a47bd8ca85ada38150ee50e7edfc77e1a352a867399d27dcae
-
Filesize
2.2MB
MD58cea9bc30046ce76a8d9d211206b9197
SHA1408b79f4b244be9e288efe7185dc915aaf4a9cbc
SHA256a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6
SHA51295d2b4117ec60f1b0d1611e742da358d77e1488a66e5f87105bb0b1e71ba016e3e153769d51701a47bd8ca85ada38150ee50e7edfc77e1a352a867399d27dcae