Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 11:52
Static task
static1
Behavioral task
behavioral1
Sample
185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe
Resource
win7-20220812-en
General
-
Target
185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe
-
Size
282KB
-
MD5
58b8732ed17532b518bd90b68b934b23
-
SHA1
dbb672289a9ebde17cb77424615a1c186995d1f3
-
SHA256
f6eb53bca5075725d889aa5de1f4541cd764bed2bd46aeefcfa4a1b018b6a4fb
-
SHA512
824e7e7cdccb4d60f72ad70fd73ea8184b1ed7b1d7b2e9a9426ec58380f3f4f769bee8b55d5d8c2450a6bfe37a2f737cc6a88c77e6bf1dde1984edc8c4e3b75c
-
SSDEEP
6144:Z4CJRQliHM5ZsM5Iszp/znpBIZYJrAHAY7e1+vJmuxt:VuYMx5IshzrInH34+Bmuxt
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ipconfig.exepid process 1508 ipconfig.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exeCaspol.exeipconfig.exedescription pid process target process PID 1404 set thread context of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1720 set thread context of 1224 1720 Caspol.exe Explorer.EXE PID 1508 set thread context of 1224 1508 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1508 ipconfig.exe -
Processes:
ipconfig.exedescription ioc process Key created \Registry\User\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
Caspol.exeipconfig.exepid process 1720 Caspol.exe 1720 Caspol.exe 1720 Caspol.exe 1720 Caspol.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Caspol.exeipconfig.exepid process 1720 Caspol.exe 1720 Caspol.exe 1720 Caspol.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe 1508 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Caspol.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1720 Caspol.exe Token: SeDebugPrivilege 1508 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exeExplorer.EXEipconfig.exedescription pid process target process PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1404 wrote to memory of 1720 1404 185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe Caspol.exe PID 1224 wrote to memory of 1508 1224 Explorer.EXE ipconfig.exe PID 1224 wrote to memory of 1508 1224 Explorer.EXE ipconfig.exe PID 1224 wrote to memory of 1508 1224 Explorer.EXE ipconfig.exe PID 1224 wrote to memory of 1508 1224 Explorer.EXE ipconfig.exe PID 1508 wrote to memory of 584 1508 ipconfig.exe Firefox.exe PID 1508 wrote to memory of 584 1508 ipconfig.exe Firefox.exe PID 1508 wrote to memory of 584 1508 ipconfig.exe Firefox.exe PID 1508 wrote to memory of 584 1508 ipconfig.exe Firefox.exe PID 1508 wrote to memory of 584 1508 ipconfig.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe"C:\Users\Admin\AppData\Local\Temp\185.246.220.121_-_vik_-_HHG.exe___58b8732ed17532b518bd90b68b934b23.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
820KB
MD5317ba2f8e624ec0c7d3714e2bde4f346
SHA112734675cfad66d78252515644a624964f69f94d
SHA2560c2093493424e885c297d613e0cf343d8a084253ca3b044415e14c6e94696877
SHA512ecc4a6f951cd7958288b7de35b253475fcc0910f5385b0b38db872a412b547ef5d8e7056865d26ae46b3b027d8b0bb37aa25ec6cb1a67abd342799795bfd3b08
-
memory/1224-67-0x0000000004CE0000-0x0000000004DC3000-memory.dmpFilesize
908KB
-
memory/1224-74-0x0000000004DD0000-0x0000000004E8F000-memory.dmpFilesize
764KB
-
memory/1224-76-0x0000000004DD0000-0x0000000004E8F000-memory.dmpFilesize
764KB
-
memory/1404-57-0x0000000000200000-0x0000000000208000-memory.dmpFilesize
32KB
-
memory/1404-54-0x00000000012D0000-0x000000000131C000-memory.dmpFilesize
304KB
-
memory/1404-56-0x00000000001F0000-0x00000000001FC000-memory.dmpFilesize
48KB
-
memory/1404-55-0x0000000000320000-0x000000000036A000-memory.dmpFilesize
296KB
-
memory/1508-70-0x0000000000DD0000-0x0000000000DDA000-memory.dmpFilesize
40KB
-
memory/1508-75-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1508-73-0x0000000000AA0000-0x0000000000B2F000-memory.dmpFilesize
572KB
-
memory/1508-71-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1508-72-0x00000000021E0000-0x00000000024E3000-memory.dmpFilesize
3.0MB
-
memory/1508-68-0x0000000000000000-mapping.dmp
-
memory/1508-69-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1720-59-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1720-66-0x0000000000180000-0x0000000000190000-memory.dmpFilesize
64KB
-
memory/1720-65-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1720-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1720-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1720-62-0x00000000004012E0-mapping.dmp
-
memory/1720-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1720-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB