Analysis
-
max time kernel
57s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-12-2022 13:28
Static task
static1
Behavioral task
behavioral1
Sample
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe
Resource
win10-20220812-en
General
-
Target
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe
-
Size
139KB
-
MD5
d91b498e5fc6c91e1e86b339407b58f7
-
SHA1
369e3c4646a69b99a797e0e288fd3145e2a6f35a
-
SHA256
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9
-
SHA512
b981f7c4857327708233bf7e44bfb485c1cc7148ca850a63b12f854215edb583f5a499109d67b94f213226d23d0f4e0e5d04b888193fa5e799e30f051e9c9dbd
-
SSDEEP
3072:XBkH2At/3YyzX2OpphkGYI+C9AwcOZBJ7zk:n6/IAFkCDc+BJ7w
Malware Config
Extracted
zloader
vlenie10
obnova10
https://kdsidsiadsakfsas.com/gate.php
https://jdafiasfjsafahhfs.com/gate.php
https://dasifosafjasfhasf.com/gate.php
https://kasfajfsafhasfhaf.com/gate.php
https://fdsjfjdsfjdsjfdjsfh.com/gate.php
https://fdsjfjdsfjdsdsjajjs.com/gate.php
https://idisaudhasdhasdj.com/gate.php
https://dsjdjsjdsadhasdas.com/gate.php
https://dsdjfhdsufudhjas.com/gate.php
-
build_id
1869505135
Signatures
-
Blocklisted process makes network request 10 IoCs
Processes:
msiexec.exeflow pid process 3 4620 msiexec.exe 4 4620 msiexec.exe 7 4620 msiexec.exe 9 4620 msiexec.exe 11 4620 msiexec.exe 13 4620 msiexec.exe 15 4620 msiexec.exe 17 4620 msiexec.exe 19 4620 msiexec.exe 21 4620 msiexec.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gucayhyb = "C:\\Users\\Admin\\AppData\\Roaming\\Fygih\\geabdo.exe" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exedescription pid process target process PID 388 set thread context of 4620 388 cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe msiexec.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 4620 msiexec.exe Token: SeSecurityPrivilege 4620 msiexec.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exedescription pid process target process PID 388 wrote to memory of 4620 388 cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe msiexec.exe PID 388 wrote to memory of 4620 388 cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe msiexec.exe PID 388 wrote to memory of 4620 388 cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe msiexec.exe PID 388 wrote to memory of 4620 388 cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe msiexec.exe PID 388 wrote to memory of 4620 388 cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe"C:\Users\Admin\AppData\Local\Temp\cad0968f5ab3bedeffef68bbe18f92946fb97967cef59970157029480ed15bb9.exe"1⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/388-115-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-116-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-117-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-118-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-119-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-120-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-121-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/388-122-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-123-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-124-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-125-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-126-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-127-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-128-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-129-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-130-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-131-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-132-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-133-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-134-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-135-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-136-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-137-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-139-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-138-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/388-140-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-141-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-142-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-143-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-144-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-145-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-146-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/388-150-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4620-148-0x0000000000000000-mapping.dmp
-
memory/4620-163-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-151-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-149-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-152-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-153-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-155-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-158-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-156-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-159-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-161-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-160-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-162-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-164-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-165-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-166-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-167-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-147-0x0000000000880000-0x00000000008A0000-memory.dmpFilesize
128KB
-
memory/4620-168-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-169-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-170-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-171-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-172-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-173-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-174-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-175-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-176-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-177-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-178-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-179-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-180-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-181-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-182-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-183-0x0000000077DF0000-0x0000000077F7E000-memory.dmpFilesize
1.6MB
-
memory/4620-202-0x0000000000880000-0x00000000008A0000-memory.dmpFilesize
128KB
-
memory/4620-227-0x0000000000880000-0x00000000008A0000-memory.dmpFilesize
128KB