Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-12-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
General
-
Target
94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe
-
Size
2.4MB
-
MD5
32ad48e02ef9597a3e29a77dff191446
-
SHA1
6daa7288df7fc8f67f22f9b2b5716642df04d43b
-
SHA256
94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b
-
SHA512
f37d438a0cd98bb217e5beaf46aab99c9bed37d456db23d91420cf5904e49959f5d0bdbdc91a781317fecc111efd37c9d68fd533a2c5a907ace77f0b60677578
-
SSDEEP
24576:+4YsDAbKJyb8W6YUY0IP0uuM+0SPaTd1dr2KquDHFBlGFpgILv8+UXl3RuQ5531T:+4YsDAbEyb8XTV4FBlGFpgID8lXl3h
Malware Config
Extracted
Family
erbium
C2
77.73.133.53
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1196 set thread context of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1196 wrote to memory of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29 PID 1196 wrote to memory of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29 PID 1196 wrote to memory of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29 PID 1196 wrote to memory of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29 PID 1196 wrote to memory of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29 PID 1196 wrote to memory of 98384 1196 94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe"C:\Users\Admin\AppData\Local\Temp\94b3f2cd0a0c184c2538b257654b6bac86454cfc56fb0c55f6c407dc608de34b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:98384
-