Analysis
-
max time kernel
232s -
max time network
240s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2022, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe
Resource
win7-20220812-en
General
-
Target
a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe
-
Size
2.2MB
-
MD5
8cea9bc30046ce76a8d9d211206b9197
-
SHA1
408b79f4b244be9e288efe7185dc915aaf4a9cbc
-
SHA256
a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6
-
SHA512
95d2b4117ec60f1b0d1611e742da358d77e1488a66e5f87105bb0b1e71ba016e3e153769d51701a47bd8ca85ada38150ee50e7edfc77e1a352a867399d27dcae
-
SSDEEP
24576:gUHmsocCmYbx4wLMR+OXY0WvY0WvY0WvY0WvY0WvY0WvY0WvY0WPY0WvY0WvY0WI:xGkYbx4wLMR+d7c
Malware Config
Extracted
systembc
spexblog17.xyz:4044
admstat45.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 388 obkgcil.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\obkgcil.job a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe File opened for modification C:\Windows\Tasks\obkgcil.job a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4488 a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe 4488 a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe"C:\Users\Admin\AppData\Local\Temp\a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
C:\ProgramData\rilkusr\obkgcil.exeC:\ProgramData\rilkusr\obkgcil.exe start21⤵
- Executes dropped EXE
PID:388
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD58cea9bc30046ce76a8d9d211206b9197
SHA1408b79f4b244be9e288efe7185dc915aaf4a9cbc
SHA256a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6
SHA51295d2b4117ec60f1b0d1611e742da358d77e1488a66e5f87105bb0b1e71ba016e3e153769d51701a47bd8ca85ada38150ee50e7edfc77e1a352a867399d27dcae
-
Filesize
2.2MB
MD58cea9bc30046ce76a8d9d211206b9197
SHA1408b79f4b244be9e288efe7185dc915aaf4a9cbc
SHA256a8bf7dbcfe29c3c9c0bed1be3cd9cc2935e2bf60313c5721e37fbad5048f67c6
SHA51295d2b4117ec60f1b0d1611e742da358d77e1488a66e5f87105bb0b1e71ba016e3e153769d51701a47bd8ca85ada38150ee50e7edfc77e1a352a867399d27dcae