Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 07:02
Static task
static1
Behavioral task
behavioral1
Sample
0e5be3896c55c18c7a309bb9373defbf.exe
Resource
win7-20220901-en
General
-
Target
0e5be3896c55c18c7a309bb9373defbf.exe
-
Size
231KB
-
MD5
0e5be3896c55c18c7a309bb9373defbf
-
SHA1
dfaa36c3bdb7450be131c522e84f22f2da7ee6b1
-
SHA256
e3df896880b51267bbbafeecf87a4c3b1c97a6a5dba9136f8731eac864424f13
-
SHA512
1c0df34bdb37a67a9c0b6867f62ba439236e9ac8f8b242049f71fb7f959a1de99d8d0ae5b7b7e5dabab30062bc6dc6eccb5eb95ddbec07e43a374d5db8a44e14
-
SSDEEP
3072:FcXNVVuNrkCwcPc6xC1pG5rQxO1/57LUYXu+6Doe0KwY:ecNrtwmE1Cz1iskn0c
Malware Config
Extracted
systembc
45.182.189.231:443
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
shkra.exepid process 2024 shkra.exe -
Drops file in Windows directory 2 IoCs
Processes:
0e5be3896c55c18c7a309bb9373defbf.exedescription ioc process File created C:\Windows\Tasks\shkra.job 0e5be3896c55c18c7a309bb9373defbf.exe File opened for modification C:\Windows\Tasks\shkra.job 0e5be3896c55c18c7a309bb9373defbf.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0e5be3896c55c18c7a309bb9373defbf.exepid process 1352 0e5be3896c55c18c7a309bb9373defbf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1684 wrote to memory of 2024 1684 taskeng.exe shkra.exe PID 1684 wrote to memory of 2024 1684 taskeng.exe shkra.exe PID 1684 wrote to memory of 2024 1684 taskeng.exe shkra.exe PID 1684 wrote to memory of 2024 1684 taskeng.exe shkra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e5be3896c55c18c7a309bb9373defbf.exe"C:\Users\Admin\AppData\Local\Temp\0e5be3896c55c18c7a309bb9373defbf.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {0CCD9567-6469-45F8-9FEC-4FF8E3C0E452} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\umhovb\shkra.exeC:\ProgramData\umhovb\shkra.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\umhovb\shkra.exeFilesize
231KB
MD50e5be3896c55c18c7a309bb9373defbf
SHA1dfaa36c3bdb7450be131c522e84f22f2da7ee6b1
SHA256e3df896880b51267bbbafeecf87a4c3b1c97a6a5dba9136f8731eac864424f13
SHA5121c0df34bdb37a67a9c0b6867f62ba439236e9ac8f8b242049f71fb7f959a1de99d8d0ae5b7b7e5dabab30062bc6dc6eccb5eb95ddbec07e43a374d5db8a44e14
-
C:\ProgramData\umhovb\shkra.exeFilesize
231KB
MD50e5be3896c55c18c7a309bb9373defbf
SHA1dfaa36c3bdb7450be131c522e84f22f2da7ee6b1
SHA256e3df896880b51267bbbafeecf87a4c3b1c97a6a5dba9136f8731eac864424f13
SHA5121c0df34bdb37a67a9c0b6867f62ba439236e9ac8f8b242049f71fb7f959a1de99d8d0ae5b7b7e5dabab30062bc6dc6eccb5eb95ddbec07e43a374d5db8a44e14
-
memory/1352-55-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1352-56-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/1352-57-0x00000000003A0000-0x00000000003A9000-memory.dmpFilesize
36KB
-
memory/1352-58-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1352-63-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/2024-60-0x0000000000000000-mapping.dmp
-
memory/2024-65-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/2024-66-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2024-67-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB