99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c

General

Target

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
Size

120KB
MD5

52e512505a4064f045f806959b203870
SHA1

fa115b03e58fbc1c0b9bbe29c6c66ae6f7ed1c68
SHA256

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c
SHA512

48c96a30ef5bd56819644292cd6f3169dccf32512084e5ed729936ef11552768f9d1c9f31ee041799d178deb96c8741460571159f4829da35e969b016d871f3f
SSDEEP

3072:BZuJ//XCJ7s548iyo5TtRBusb1NFIM0b:a/f+Sy5TtRBFbrFYb

Score

7^/10

evasion

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

Explorer.EXE

pid process

1312 Explorer.EXE

pid	process
1312	Explorer.EXE

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\WINE	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

description	pid	process	target process
PID 820 set thread context of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1312 Explorer.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

pid process

328 99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

pid process

820 99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

pid	process
1312	Explorer.EXE

pid	process
328	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

pid	process
820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe

description	pid	process	target process
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 820 wrote to memory of 328	820	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
PID 328 wrote to memory of 1312	328	99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: GetForegroundWindowSpam
PID:1312

C:\Users\Admin\AppData\Local\Temp\99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
"C:\Users\Admin\AppData\Local\Temp\99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820

C:\Users\Admin\AppData\Local\Temp\99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe
"C:\Users\Admin\AppData\Local\Temp\99740f0431124b30a680612c05e5816df123522cb984403b624ef95612c8279c.exe"
3⤵
- Identifies Wine through registry keys
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:328

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-57-0x000000000040F4F6-mapping.dmp

Download
memory/328-56-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/328-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/328-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1312-61-0x00000000025C0000-0x00000000025D8000-memory.dmp

Filesize
96KB

Download
memory/1312-62-0x00000000025C0000-0x00000000025D8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads