3a6ff8e3ab8b15036ff5a4e6fcaf4c84d0a122d3f6f2636dc10af77068896f62

Analysis

max time kernel
121s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.6MB
Sample221126-wpqfpsdc64
SHA256 3a6ff8e3ab8b15036ff5a4e6fcaf4c84d0a122d3f6f2636dc10af77068896f62
MD5 0708429f417aae8064115f578af961d9
SHA1 dfe329f1bf28f6aa0f4b99e8562e4b553a1363dc
SHA512 e7fd0ad89ab2f123dad92059deafb206d81d6044f91b4dd7faed0f50bba5c3c1afb0f293f3af6bb8b4bfabd90f7d91dc5b98b11bc5b016dc3e35a7cc44e21d07
SSDEEP 49152:g/7Fsss0K1U0zp+Z9vAaE5FKY/t764UzLUA/AOiyjrbsnHzvSn9r8fN/u9Mj9VnF:Y5sl/V+Zp4UzJ/TknTZBYXOY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3832	oKvLqPxQct.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3468	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	28	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2032	2532	file.exe	82
PID 2532 wrote to memory of 2032	2532	file.exe	82
PID 2532 wrote to memory of 2032	2532	file.exe	82
PID 2032 wrote to memory of 3468	2032	cmd.exe	84
PID 2032 wrote to memory of 3468	2032	cmd.exe	84
PID 2032 wrote to memory of 3468	2032	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn nRfYhdpBEP /tr C:\Users\Admin\AppData\Roaming\nRfYhdpBEP\oKvLqPxQct.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn nRfYhdpBEP /tr C:\Users\Admin\AppData\Roaming\nRfYhdpBEP\oKvLqPxQct.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:3468

C:\Users\Admin\AppData\Roaming\nRfYhdpBEP\oKvLqPxQct.exe
C:\Users\Admin\AppData\Roaming\nRfYhdpBEP\oKvLqPxQct.exe
1⤵
- Executes dropped EXE
PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oKvLqPxQct.exe

Path C:\Users\Admin\AppData\Roaming\nRfYhdpBEP\oKvLqPxQct.exe
Size 611.3MB
SHA256 4563be7216a55ba82685f93eebfe324631751e00967ddf3c7f2b986611f637c8
MD5 fc8aa85c9e39a8b2218f04adf2300eef
SHA1 d7e498fe0bd66d1fa15f50f318ae67b4e753527b
SHA512 4d068cfe21e3438801609c74d7b40458c4365849a0e996890b7e21c001b59f4e276c910bbcba75ea563491589341ea7d420307fa50e9188938287f8d0d2397c2
SSDEEP 12582912:Ez2VYE5Ug/XoCRsAlMtan30Lt5mCRJfQA5GgJmdKClDpRYL2qEPvN4Y:E6nUs7I7F5dJzfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

oKvLqPxQct.exe

Path C:\Users\Admin\AppData\Roaming\nRfYhdpBEP\oKvLqPxQct.exe
Size 611.3MB
SHA256 4563be7216a55ba82685f93eebfe324631751e00967ddf3c7f2b986611f637c8
MD5 fc8aa85c9e39a8b2218f04adf2300eef
SHA1 d7e498fe0bd66d1fa15f50f318ae67b4e753527b
SHA512 4d068cfe21e3438801609c74d7b40458c4365849a0e996890b7e21c001b59f4e276c910bbcba75ea563491589341ea7d420307fa50e9188938287f8d0d2397c2
SSDEEP 12582912:Ez2VYE5Ug/XoCRsAlMtan30Lt5mCRJfQA5GgJmdKClDpRYL2qEPvN4Y:E6nUs7I7F5dJzfY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads