Analysis
-
max time kernel
187s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 05:32
Static task
static1
Behavioral task
behavioral1
Sample
aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe
Resource
win10v2004-20221111-en
General
-
Target
aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe
-
Size
106KB
-
MD5
706506e195b21169bc7c2c127edc0001
-
SHA1
5a130007a382cf81c98917d90efbc280b31912c7
-
SHA256
aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178
-
SHA512
778f2fb4a4d24b450b31709aa101814a3cd800699f3235917bb184032672c60436ed62e01d1d651db8488584a7f8d8bc67d08eb0400c27db4237ef2378d44bb0
-
SSDEEP
1536:EoHW4VGNHzisAJMfiqIYgDeVOGXzDA9MjFPdi8oB7LLqd/aZPPDpet1nnCnA:EoHW4IxkIMYueUGXvbR1iLlw/aFD2nCA
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ejbkxqrx = "\"C:\\Users\\Admin\\AppData\\Local\\witgumaf.exe\"" svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exepid process 2008 aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe 2008 aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exedescription pid process target process PID 2008 wrote to memory of 3328 2008 aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe svchost.exe PID 2008 wrote to memory of 3328 2008 aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe svchost.exe PID 2008 wrote to memory of 3328 2008 aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe"C:\Users\Admin\AppData\Local\Temp\aa470524c3960ab9f00f2401b8a30c3caf6d344c410edcb324a5b3a6e7af8178.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2008-132-0x0000000000580000-0x0000000000594000-memory.dmpFilesize
80KB
-
memory/3328-134-0x0000000000000000-mapping.dmp
-
memory/3328-135-0x0000000000530000-0x000000000053E000-memory.dmpFilesize
56KB
-
memory/3328-136-0x0000000000D10000-0x0000000000D21000-memory.dmpFilesize
68KB
-
memory/3328-137-0x0000000001510000-0x0000000001590000-memory.dmpFilesize
512KB
-
memory/3328-138-0x0000000001510000-0x0000000001590000-memory.dmpFilesize
512KB