Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 23:38
Behavioral task
behavioral1
Sample
01e41c6c98570e09c9fc8ec72210274a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
01e41c6c98570e09c9fc8ec72210274a.exe
Resource
win10v2004-20220901-en
General
-
Target
01e41c6c98570e09c9fc8ec72210274a.exe
-
Size
3.8MB
-
MD5
01e41c6c98570e09c9fc8ec72210274a
-
SHA1
12112ce4a4be93f7c780732ab0a355c4541326d3
-
SHA256
6b4c21cbed920beb4a80ab7c1a5b385854c8c13dcfbe5601d31b4a4e64afe8f3
-
SHA512
9c97163ad34edfc832835f300a551b4275e28522eef217f36ec8807ab0b2a0b8094f6f009d2c0d6740bb454b07e520ab0946ee0f17607967524c357f65f5c345
-
SSDEEP
98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/OmlwXVZ4FB:5+R/eZADUXR
Malware Config
Extracted
bitrat
1.38
192.253.229.215:5877
-
communication_password
c4ca4238a0b923820dcc509a6f75849b
-
install_dir
C:\Windows\System32
-
install_file
notepad
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
01e41c6c98570e09c9fc8ec72210274a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Local\\C:\\Windows\\System32\\notepad" 01e41c6c98570e09c9fc8ec72210274a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
01e41c6c98570e09c9fc8ec72210274a.exepid process 748 01e41c6c98570e09c9fc8ec72210274a.exe 748 01e41c6c98570e09c9fc8ec72210274a.exe 748 01e41c6c98570e09c9fc8ec72210274a.exe 748 01e41c6c98570e09c9fc8ec72210274a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
01e41c6c98570e09c9fc8ec72210274a.exedescription pid process Token: SeDebugPrivilege 748 01e41c6c98570e09c9fc8ec72210274a.exe Token: SeShutdownPrivilege 748 01e41c6c98570e09c9fc8ec72210274a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
01e41c6c98570e09c9fc8ec72210274a.exepid process 748 01e41c6c98570e09c9fc8ec72210274a.exe 748 01e41c6c98570e09c9fc8ec72210274a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e41c6c98570e09c9fc8ec72210274a.exe"C:\Users\Admin\AppData\Local\Temp\01e41c6c98570e09c9fc8ec72210274a.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:748