8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c

General

Target

8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe
Size

35KB
MD5

07e0170aa21af5210d7ac6cb6045e189
SHA1

7ec3d1aa365b5be087a98dc8b556afca401f02f0
SHA256

8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c
SHA512

238f8fcb23228ee00249f3821a069addda595047cad60d54c25730f6537fa64ad65c8093af85de751279a70defb0254cc1a9a71f906d4ea4e8d8038e430f161a
SSDEEP

768:VMT+X2xWTeOf9MIj0be7K89WYFIGZcGaLzYVXQPjiE:Vo+X2xWVXJe83JZ+0AX

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 32 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	85.255.115.4
Destination IP	85.255.115.4
Destination IP	85.255.115.4
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.115.4
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.112.15
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.112.15
Destination IP	85.255.115.4
Destination IP	85.255.112.15
Destination IP	85.255.112.15
Destination IP	85.255.115.4

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vbsff.exe	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe
File opened for modification	C:\Windows\SysWOW64\vbsff.exe	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4464 set thread context of 4688	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	84
PID 4464 set thread context of 2484	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	85

Gathers network information 2 TTPs 5 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
3760	ipconfig.exe
1784	ipconfig.exe
2044	ipconfig.exe
3156	ipconfig.exe
308	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4688	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	84
PID 4464 wrote to memory of 4688	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	84
PID 4464 wrote to memory of 4688	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	84
PID 4464 wrote to memory of 4688	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	84
PID 4464 wrote to memory of 2484	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	85
PID 4464 wrote to memory of 2484	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	85
PID 4464 wrote to memory of 2484	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	85
PID 4464 wrote to memory of 2484	4464	8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe	85
PID 4688 wrote to memory of 3156	4688	iexplore.exe	86
PID 4688 wrote to memory of 3156	4688	iexplore.exe	86
PID 4688 wrote to memory of 3156	4688	iexplore.exe	86
PID 4688 wrote to memory of 308	4688	iexplore.exe	88
PID 4688 wrote to memory of 308	4688	iexplore.exe	88
PID 4688 wrote to memory of 308	4688	iexplore.exe	88
PID 4688 wrote to memory of 3760	4688	iexplore.exe	90
PID 4688 wrote to memory of 3760	4688	iexplore.exe	90
PID 4688 wrote to memory of 3760	4688	iexplore.exe	90
PID 4688 wrote to memory of 1784	4688	iexplore.exe	92
PID 4688 wrote to memory of 1784	4688	iexplore.exe	92
PID 4688 wrote to memory of 1784	4688	iexplore.exe	92
PID 4688 wrote to memory of 2044	4688	iexplore.exe	94
PID 4688 wrote to memory of 2044	4688	iexplore.exe	94
PID 4688 wrote to memory of 2044	4688	iexplore.exe	94

C:\Users\Admin\AppData\Local\Temp\8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe
"C:\Users\Admin\AppData\Local\Temp\8da79559ec1271a99695235093dd46e070b5efa59ff41684e590a0633c664f3c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:3156
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /registerdns
    3⤵
    - Gathers network information
    PID:308
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /dnsflush
    3⤵
    - Gathers network information
    PID:3760
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /renew
    3⤵
    - Gathers network information
    PID:1784
- - C:\Windows\SysWOW64\ipconfig.exe
    "C:\Windows\System32\ipconfig.exe" /renew_all
    3⤵
    - Gathers network information
    PID:2044
- C:\Windows\SysWOW64\Explorer.exe
  Explorer.exe
  2⤵
  PID:2484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4464-132-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4464-134-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing