Analysis
-
max time kernel
172s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 06:20
Static task
static1
Behavioral task
behavioral1
Sample
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe
Resource
win10v2004-20220812-en
General
-
Target
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe
-
Size
137KB
-
MD5
35dbf14ccd580c19ade8b4378b7ef228
-
SHA1
02922d258a6379fb369c99b4a7bba9ebc8786ac4
-
SHA256
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab
-
SHA512
47ae2c57fa7bcbff0e98ae41bb9a8151ac8a24e70120d549021a903fc9e99cf9688233116e8458ae1ff61861ed6150a7e4652be974b2c3cbeebf6c7019e8cab3
-
SSDEEP
3072:cNhD3Ybr7iSRjtfZ7sahit8k5ZzA8BrtRC/+zouEVetkYWVwBJZkVWqHqd:2sbvd4ahitplAyfCYNM5uBJZHqH
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6f9d0d81.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*f9d0d8 = "C:\\6f9d0d81\\6f9d0d81.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6f9d0d81 = "C:\\Users\\Admin\\AppData\\Roaming\\6f9d0d81.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*f9d0d81 = "C:\\Users\\Admin\\AppData\\Roaming\\6f9d0d81.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6f9d0d8 = "C:\\6f9d0d81\\6f9d0d81.exe" explorer.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 ip-addr.es 27 ip-addr.es -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exedescription pid process target process PID 1648 set thread context of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exeexplorer.exepid process 4320 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 3324 explorer.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exeexplorer.exedescription pid process target process PID 1648 wrote to memory of 5012 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 5012 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 5012 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 1648 wrote to memory of 4320 1648 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe PID 4320 wrote to memory of 3324 4320 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe explorer.exe PID 4320 wrote to memory of 3324 4320 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe explorer.exe PID 4320 wrote to memory of 3324 4320 4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe explorer.exe PID 3324 wrote to memory of 4708 3324 explorer.exe svchost.exe PID 3324 wrote to memory of 4708 3324 explorer.exe svchost.exe PID 3324 wrote to memory of 4708 3324 explorer.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe"C:\Users\Admin\AppData\Local\Temp\4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe"C:\Users\Admin\AppData\Local\Temp\4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe"C:\Users\Admin\AppData\Local\Temp\4345a7bbe08110277171dd9c6a6d7736e220d5d7ef11d9d082b18b857a7941ab.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-132-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/1648-134-0x0000000074AB0000-0x0000000075061000-memory.dmpFilesize
5.7MB
-
memory/3324-136-0x0000000000000000-mapping.dmp
-
memory/3324-138-0x0000000000190000-0x00000000001B5000-memory.dmpFilesize
148KB
-
memory/4320-133-0x0000000000000000-mapping.dmp
-
memory/4320-135-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4320-137-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/4708-139-0x0000000000000000-mapping.dmp
-
memory/4708-140-0x0000000000810000-0x0000000000835000-memory.dmpFilesize
148KB
-
memory/4708-141-0x0000000000810000-0x0000000000835000-memory.dmpFilesize
148KB