Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 14:29
Static task
static1
Behavioral task
behavioral1
Sample
fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe
Resource
win7-20221111-en
General
-
Target
fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe
-
Size
156KB
-
MD5
e62582236c24973720e092adec05f8c5
-
SHA1
dc865394a456b89282bf248eeff3509ec0116911
-
SHA256
fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23
-
SHA512
702960c841eec4c16d4b686c1cafe42d1568e3cde1aebca4c2feaef275dc9efd5dea8e6260d4a18f92d63640bd530ccb071de42a6511a7719fbbe7ee2b9bda2a
-
SSDEEP
3072:SXiOd5A7ENBKYEm9/1fUQcl7XcOOILUJC2PsrZLILNNOmr:SXiEA7EfKYE6RU1AnvspsP
Malware Config
Extracted
systembc
advertrex20.xyz:4044
gentexman37.xyz:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
exeoud.exepid process 516 exeoud.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org 8 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exedescription ioc process File created C:\Windows\Tasks\exeoud.job fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe File opened for modification C:\Windows\Tasks\exeoud.job fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exepid process 1112 fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 596 wrote to memory of 516 596 taskeng.exe exeoud.exe PID 596 wrote to memory of 516 596 taskeng.exe exeoud.exe PID 596 wrote to memory of 516 596 taskeng.exe exeoud.exe PID 596 wrote to memory of 516 596 taskeng.exe exeoud.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe"C:\Users\Admin\AppData\Local\Temp\fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {7D066F29-BDA6-479C-B856-56534F0AD18F} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\uabwpb\exeoud.exeC:\ProgramData\uabwpb\exeoud.exe start2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\uabwpb\exeoud.exeFilesize
156KB
MD5e62582236c24973720e092adec05f8c5
SHA1dc865394a456b89282bf248eeff3509ec0116911
SHA256fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23
SHA512702960c841eec4c16d4b686c1cafe42d1568e3cde1aebca4c2feaef275dc9efd5dea8e6260d4a18f92d63640bd530ccb071de42a6511a7719fbbe7ee2b9bda2a
-
C:\ProgramData\uabwpb\exeoud.exeFilesize
156KB
MD5e62582236c24973720e092adec05f8c5
SHA1dc865394a456b89282bf248eeff3509ec0116911
SHA256fb45af7bb8ffdcddaaec2a9e88968fbcb82eaedbdf1c16a7e9ac861906a07e23
SHA512702960c841eec4c16d4b686c1cafe42d1568e3cde1aebca4c2feaef275dc9efd5dea8e6260d4a18f92d63640bd530ccb071de42a6511a7719fbbe7ee2b9bda2a
-
memory/516-59-0x0000000000000000-mapping.dmp
-
memory/516-63-0x00000000009FB000-0x0000000000A02000-memory.dmpFilesize
28KB
-
memory/516-64-0x0000000000400000-0x00000000008C6000-memory.dmpFilesize
4.8MB
-
memory/516-65-0x00000000009FB000-0x0000000000A02000-memory.dmpFilesize
28KB
-
memory/1112-54-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/1112-55-0x0000000000A4B000-0x0000000000A52000-memory.dmpFilesize
28KB
-
memory/1112-56-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1112-57-0x0000000000400000-0x00000000008C6000-memory.dmpFilesize
4.8MB
-
memory/1112-62-0x0000000000A4B000-0x0000000000A52000-memory.dmpFilesize
28KB