Analysis
-
max time kernel
57s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:10
Static task
static1
Behavioral task
behavioral1
Sample
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe
Resource
win10v2004-20221111-en
General
-
Target
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe
-
Size
166KB
-
MD5
1225cf024f08fdf7741a0f8f9aa4e017
-
SHA1
18058c507f8b6a4574405b054b8e8f7b19052d7d
-
SHA256
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc
-
SHA512
4f76c84e1906eee5993c09d4d748c6faa9ddaeff3b4c097e8b10c20395d9ee1a7a10126a7968d37a64d28589f19df671057e3cf384cd66972e298717f4caa8c4
-
SSDEEP
3072:+/LXSE0vf7vHDBDRMxquipkcC3uewF2qH1NcZm7fJOWRwao9OgXcp:8ODRM8uqC35wFx/cZkhOIbOPu
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 1464 svchost.exe 1440 svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1464 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exepid process 1952 c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe 1952 c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mslivemsn = "C:\\Users\\Admin\\Librarys\\wgesdwx\\svchost.exe" c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exesvchost.exedescription pid process target process PID 1952 wrote to memory of 1464 1952 c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe svchost.exe PID 1952 wrote to memory of 1464 1952 c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe svchost.exe PID 1952 wrote to memory of 1464 1952 c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe svchost.exe PID 1952 wrote to memory of 1464 1952 c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe svchost.exe PID 1464 wrote to memory of 1440 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1440 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1440 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1440 1464 svchost.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe"C:\Users\Admin\AppData\Local\Temp\c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Librarys\wgesdwx\svchost.exeC:\Users\Admin\Librarys\wgesdwx\svchost.exe "C:\Users\Admin\AppData\Local\Temp\c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Librarys\wgesdwx\svchost.exeC:\Users\Admin\Librarys\wgesdwx\svchost.exe --kk3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Librarys\wgesdwx\svchost.exeFilesize
166KB
MD51225cf024f08fdf7741a0f8f9aa4e017
SHA118058c507f8b6a4574405b054b8e8f7b19052d7d
SHA256c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc
SHA5124f76c84e1906eee5993c09d4d748c6faa9ddaeff3b4c097e8b10c20395d9ee1a7a10126a7968d37a64d28589f19df671057e3cf384cd66972e298717f4caa8c4
-
C:\Users\Admin\Librarys\wgesdwx\svchost.exeFilesize
166KB
MD51225cf024f08fdf7741a0f8f9aa4e017
SHA118058c507f8b6a4574405b054b8e8f7b19052d7d
SHA256c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc
SHA5124f76c84e1906eee5993c09d4d748c6faa9ddaeff3b4c097e8b10c20395d9ee1a7a10126a7968d37a64d28589f19df671057e3cf384cd66972e298717f4caa8c4
-
C:\Users\Admin\Librarys\wgesdwx\svchost.exeFilesize
166KB
MD51225cf024f08fdf7741a0f8f9aa4e017
SHA118058c507f8b6a4574405b054b8e8f7b19052d7d
SHA256c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc
SHA5124f76c84e1906eee5993c09d4d748c6faa9ddaeff3b4c097e8b10c20395d9ee1a7a10126a7968d37a64d28589f19df671057e3cf384cd66972e298717f4caa8c4
-
\Users\Admin\Librarys\wgesdwx\svchost.exeFilesize
166KB
MD51225cf024f08fdf7741a0f8f9aa4e017
SHA118058c507f8b6a4574405b054b8e8f7b19052d7d
SHA256c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc
SHA5124f76c84e1906eee5993c09d4d748c6faa9ddaeff3b4c097e8b10c20395d9ee1a7a10126a7968d37a64d28589f19df671057e3cf384cd66972e298717f4caa8c4
-
\Users\Admin\Librarys\wgesdwx\svchost.exeFilesize
166KB
MD51225cf024f08fdf7741a0f8f9aa4e017
SHA118058c507f8b6a4574405b054b8e8f7b19052d7d
SHA256c1a4652dab20886ee5b938184653a0b2d1b95616557353cace78d415553c89bc
SHA5124f76c84e1906eee5993c09d4d748c6faa9ddaeff3b4c097e8b10c20395d9ee1a7a10126a7968d37a64d28589f19df671057e3cf384cd66972e298717f4caa8c4
-
memory/1440-76-0x0000000000000000-mapping.dmp
-
memory/1440-86-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1440-87-0x0000000000270000-0x0000000000295000-memory.dmpFilesize
148KB
-
memory/1440-82-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1440-83-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1464-74-0x0000000000270000-0x0000000000295000-memory.dmpFilesize
148KB
-
memory/1464-64-0x0000000000000000-mapping.dmp
-
memory/1464-85-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1464-73-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1464-84-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1464-75-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1952-58-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1952-59-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1952-66-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1952-54-0x0000000000270000-0x0000000000295000-memory.dmpFilesize
148KB
-
memory/1952-67-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/1952-60-0x0000000000270000-0x0000000000295000-memory.dmpFilesize
148KB
-
memory/1952-55-0x0000000000270000-0x0000000000295000-memory.dmpFilesize
148KB
-
memory/1952-61-0x0000000000271000-0x0000000000287000-memory.dmpFilesize
88KB