3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x0009000000012301-55.exe
Size 4.6MB
Sample221129-hv57fsff42
SHA256 3c39c19a17c68b76ab916e85cc9d7a2e24525f4099a6d258f28dd27353febd25
MD5 21f79006cf7560986de8ec8a60998894
SHA1 b4e170268721f7ddfb33c2cb5af3f953a0f16278
SHA512 f794f98972f9a7ee2cf5ee9541db8f83d6670cea95289dd8f55a52d576b2fdce58136d21b85f278ca28e545c522efecaea6529736ca89e62f8f596bd102f5615
SSDEEP 49152:rB3pvIEnEFeJAzS3Z1vAaE5FKY/t7mWcz64tVD2uCLfP5/xfKopX8Lh1eFY2xMQe:lZAxD23ZVWczxVCN/FGTQW81
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4952	FRWxXtyVnj.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
996	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	39	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 4596	3692	0x0009000000012301-55.exe	81
PID 3692 wrote to memory of 4596	3692	0x0009000000012301-55.exe	81
PID 3692 wrote to memory of 4596	3692	0x0009000000012301-55.exe	81
PID 4596 wrote to memory of 996	4596	cmd.exe	83
PID 4596 wrote to memory of 996	4596	cmd.exe	83
PID 4596 wrote to memory of 996	4596	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\0x0009000000012301-55.exe
"C:\Users\Admin\AppData\Local\Temp\0x0009000000012301-55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn RYplbyBDUW /tr C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn RYplbyBDUW /tr C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:996

C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
1⤵
- Executes dropped EXE
PID:4952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FRWxXtyVnj.exe

Path C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
Size 304.8MB
SHA256 05fb010c23eb7850af21a75814717aacfaebbbee7c78b7d8dac0f749479384d3
MD5 bfb3613f0b2dc8459932605332aaa8ba
SHA1 3dbcc324e4dfdebe077b8c2663b563378c4d77e1
SHA512 76aa2825d443d8fbaa67da14d406563cd5a8c1ff74b8f5b7a648f576692d518adec5cda83d1fd05ab59bf3cf9d89bb9b7f1a1adbeedb2781615819e18989657d
SSDEEP 6291456:5JXUXxyJGG6dLVQ55D4BSJnmgw7avmMy+ptA67hlKpCf:vYxptL25nbwQmLmtokf
MD5 SHA1 SHA512 SSDEEP

Submit Download

FRWxXtyVnj.exe

Path C:\Users\Admin\AppData\Roaming\RYplbyBDUW\FRWxXtyVnj.exe
Size 304.8MB
SHA256 05fb010c23eb7850af21a75814717aacfaebbbee7c78b7d8dac0f749479384d3
MD5 bfb3613f0b2dc8459932605332aaa8ba
SHA1 3dbcc324e4dfdebe077b8c2663b563378c4d77e1
SHA512 76aa2825d443d8fbaa67da14d406563cd5a8c1ff74b8f5b7a648f576692d518adec5cda83d1fd05ab59bf3cf9d89bb9b7f1a1adbeedb2781615819e18989657d
SSDEEP 6291456:5JXUXxyJGG6dLVQ55D4BSJnmgw7avmMy+ptA67hlKpCf:vYxptL25nbwQmLmtokf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads