Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2022, 10:29
Static task
static1
General
-
Target
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe
-
Size
218KB
-
MD5
cdc67700f25eaed1417264c4bdec03d3
-
SHA1
56639e9414e6ee8394d940d62778475ddf071290
-
SHA256
fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
-
SHA512
a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
SSDEEP
3072:ErayULJ3h3C59R+rVZxzAskAGbhAzT69ohOP+L+h7b/MxuCwLgNHCDml:E2yUL1JC4fxUspGbhgT62hO2LC2HCa
Malware Config
Extracted
systembc
109.205.214.18:443
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4908 lxava.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\lxava.job fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe File created C:\Windows\Tasks\lxava.job fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3048 3444 WerFault.exe 80 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3444 fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe 3444 fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe"C:\Users\Admin\AppData\Local\Temp\fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 9562⤵
- Program crash
PID:3048
-
-
C:\ProgramData\imbhou\lxava.exeC:\ProgramData\imbhou\lxava.exe start1⤵
- Executes dropped EXE
PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3444 -ip 34441⤵PID:4504
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038
-
Filesize
218KB
MD5cdc67700f25eaed1417264c4bdec03d3
SHA156639e9414e6ee8394d940d62778475ddf071290
SHA256fdd4cca0516be799c954e96be26b2d04e42ea0bac1edb00604412914bae2f100
SHA512a2b38a1d4d0cb57532f3feb2efa1fb345c03df9114dfb2dcc93286e19b96eb5e182bd79d070a0e4fccf1980f47effc9b511dbb0074bba69bee80098317e08038