Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 20:29
Static task
static1
Behavioral task
behavioral1
Sample
d49997877451b110adc8e09d9c04c2b6.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
-
Target
d49997877451b110adc8e09d9c04c2b6.exe
-
Size
1.7MB
-
MD5
d49997877451b110adc8e09d9c04c2b6
-
SHA1
602504addbd4df06c2ae5467a037edbf4fc41c16
-
SHA256
bff34ec881bbe9726f025fcf4585150e98178bd2ecdbc7fc29939dbf554ab708
-
SHA512
7e4e0acecf1b00234fb08c1441b6917cc3c65d4f9b27f369812ff0a719aee4dbae995d00b36ab7eaf97e09f8be27b54c0ec5a80043c3dd4b2340824d5c850664
-
SSDEEP
49152:Zk7edbYPPeMgp1wQ4H4/Kof7Of6Dmq9zbrQn:Z/dMPPEYQlNqfVUQn
Malware Config
Extracted
Family
systembc
C2
89.22.225.242:4193
195.2.93.22:4193
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
d49997877451b110adc8e09d9c04c2b6.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat d49997877451b110adc8e09d9c04c2b6.exe -
Drops file in Windows directory 2 IoCs
Processes:
d49997877451b110adc8e09d9c04c2b6.exedescription ioc process File created C:\Windows\Tasks\wow64.job d49997877451b110adc8e09d9c04c2b6.exe File opened for modification C:\Windows\Tasks\wow64.job d49997877451b110adc8e09d9c04c2b6.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
d49997877451b110adc8e09d9c04c2b6.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings d49997877451b110adc8e09d9c04c2b6.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
d49997877451b110adc8e09d9c04c2b6.exed49997877451b110adc8e09d9c04c2b6.exepid process 1884 d49997877451b110adc8e09d9c04c2b6.exe 1884 d49997877451b110adc8e09d9c04c2b6.exe 1884 d49997877451b110adc8e09d9c04c2b6.exe 1884 d49997877451b110adc8e09d9c04c2b6.exe 1884 d49997877451b110adc8e09d9c04c2b6.exe 1936 d49997877451b110adc8e09d9c04c2b6.exe 1936 d49997877451b110adc8e09d9c04c2b6.exe 1936 d49997877451b110adc8e09d9c04c2b6.exe 1936 d49997877451b110adc8e09d9c04c2b6.exe 1936 d49997877451b110adc8e09d9c04c2b6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 2028 wrote to memory of 1936 2028 taskeng.exe d49997877451b110adc8e09d9c04c2b6.exe PID 2028 wrote to memory of 1936 2028 taskeng.exe d49997877451b110adc8e09d9c04c2b6.exe PID 2028 wrote to memory of 1936 2028 taskeng.exe d49997877451b110adc8e09d9c04c2b6.exe PID 2028 wrote to memory of 1936 2028 taskeng.exe d49997877451b110adc8e09d9c04c2b6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d49997877451b110adc8e09d9c04c2b6.exe"C:\Users\Admin\AppData\Local\Temp\d49997877451b110adc8e09d9c04c2b6.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {DAAB5A7F-41D5-40EE-8C99-ADFCB0002733} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d49997877451b110adc8e09d9c04c2b6.exeC:\Users\Admin\AppData\Local\Temp\d49997877451b110adc8e09d9c04c2b6.exe start2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-71-0x000000000B0B0000-0x000000000B130000-memory.dmpFilesize
512KB
-
memory/1884-55-0x0000000002090000-0x0000000002937000-memory.dmpFilesize
8.7MB
-
memory/1884-56-0x0000000002090000-0x0000000002937000-memory.dmpFilesize
8.7MB
-
memory/1884-57-0x0000000001E90000-0x0000000001FFD000-memory.dmpFilesize
1.4MB
-
memory/1884-58-0x0000000001E90000-0x0000000001FFD000-memory.dmpFilesize
1.4MB
-
memory/1884-59-0x0000000002090000-0x0000000002937000-memory.dmpFilesize
8.7MB
-
memory/1884-60-0x0000000001E90000-0x0000000001FFD000-memory.dmpFilesize
1.4MB
-
memory/1884-61-0x000000000B0B0000-0x000000000B130000-memory.dmpFilesize
512KB
-
memory/1884-62-0x0000000000610000-0x0000000000617000-memory.dmpFilesize
28KB
-
memory/1884-78-0x0000000001E90000-0x0000000001FFD000-memory.dmpFilesize
1.4MB
-
memory/1884-54-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/1936-67-0x0000000000B70000-0x0000000001417000-memory.dmpFilesize
8.7MB
-
memory/1936-69-0x0000000001420000-0x000000000158D000-memory.dmpFilesize
1.4MB
-
memory/1936-70-0x0000000001420000-0x000000000158D000-memory.dmpFilesize
1.4MB
-
memory/1936-68-0x0000000000B70000-0x0000000001417000-memory.dmpFilesize
8.7MB
-
memory/1936-72-0x0000000000B70000-0x0000000001417000-memory.dmpFilesize
8.7MB
-
memory/1936-73-0x0000000001420000-0x000000000158D000-memory.dmpFilesize
1.4MB
-
memory/1936-74-0x000000000DB90000-0x000000000DC10000-memory.dmpFilesize
512KB
-
memory/1936-75-0x0000000000330000-0x0000000000337000-memory.dmpFilesize
28KB
-
memory/1936-65-0x0000000000000000-mapping.dmp
-
memory/1936-79-0x000000000DB90000-0x000000000DC10000-memory.dmpFilesize
512KB