Analysis
-
max time kernel
99s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:24
Behavioral task
behavioral1
Sample
42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe
Resource
win7-20221111-en
General
-
Target
42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe
-
Size
122KB
-
MD5
5f866e1c597b23ae2df3f60545b36888
-
SHA1
864d6aa509ca82f4a0bc832a24f629fcaf432f73
-
SHA256
42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac
-
SHA512
59f132b74135742bf7b5ba7a065090762e685b78890a623adc99849a2e115b3555069f6f196bcebc5fa73f2bbd2509e4b7a108210b37b280f42fc384ad16524b
-
SSDEEP
3072:d98eW81vrk4AZuZoJ7irczoZp9mp8YD2n+h3Z:A0RrkXZuA7ircEZp9mp8YD2ng
Malware Config
Extracted
systembc
185.197.74.227:4053
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tnvfj.exetnvfj.exepid process 544 tnvfj.exe 872 tnvfj.exe -
Processes:
resource yara_rule C:\ProgramData\hqsq\tnvfj.exe upx C:\ProgramData\hqsq\tnvfj.exe upx C:\ProgramData\hqsq\tnvfj.exe upx -
Drops file in Windows directory 2 IoCs
Processes:
42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exedescription ioc process File created C:\Windows\Tasks\corolina17.job 42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe File opened for modification C:\Windows\Tasks\corolina17.job 42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exepid process 948 42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exedescription pid process target process PID 1492 wrote to memory of 544 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 544 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 544 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 544 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 872 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 872 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 872 1492 taskeng.exe tnvfj.exe PID 1492 wrote to memory of 872 1492 taskeng.exe tnvfj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe"C:\Users\Admin\AppData\Local\Temp\42eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {5759CD0B-F06C-451C-909E-506BDB339C02} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\hqsq\tnvfj.exeC:\ProgramData\hqsq\tnvfj.exe start22⤵
- Executes dropped EXE
-
C:\ProgramData\hqsq\tnvfj.exeC:\ProgramData\hqsq\tnvfj.exe start22⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hqsq\tnvfj.exeFilesize
122KB
MD55f866e1c597b23ae2df3f60545b36888
SHA1864d6aa509ca82f4a0bc832a24f629fcaf432f73
SHA25642eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac
SHA51259f132b74135742bf7b5ba7a065090762e685b78890a623adc99849a2e115b3555069f6f196bcebc5fa73f2bbd2509e4b7a108210b37b280f42fc384ad16524b
-
C:\ProgramData\hqsq\tnvfj.exeFilesize
122KB
MD55f866e1c597b23ae2df3f60545b36888
SHA1864d6aa509ca82f4a0bc832a24f629fcaf432f73
SHA25642eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac
SHA51259f132b74135742bf7b5ba7a065090762e685b78890a623adc99849a2e115b3555069f6f196bcebc5fa73f2bbd2509e4b7a108210b37b280f42fc384ad16524b
-
C:\ProgramData\hqsq\tnvfj.exeFilesize
122KB
MD55f866e1c597b23ae2df3f60545b36888
SHA1864d6aa509ca82f4a0bc832a24f629fcaf432f73
SHA25642eb6fcf205d9b6e03bf2ee53945825f5b43fc97d517d145df6e08904e3aebac
SHA51259f132b74135742bf7b5ba7a065090762e685b78890a623adc99849a2e115b3555069f6f196bcebc5fa73f2bbd2509e4b7a108210b37b280f42fc384ad16524b
-
memory/544-64-0x00000000002B3000-0x00000000002B6000-memory.dmpFilesize
12KB
-
memory/544-59-0x0000000000000000-mapping.dmp
-
memory/544-62-0x00000000002B3000-0x00000000002B6000-memory.dmpFilesize
12KB
-
memory/544-63-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/872-65-0x0000000000000000-mapping.dmp
-
memory/872-68-0x0000000000BF3000-0x0000000000BF6000-memory.dmpFilesize
12KB
-
memory/872-69-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/872-70-0x0000000000BF3000-0x0000000000BF6000-memory.dmpFilesize
12KB
-
memory/948-57-0x0000000000292000-0x0000000000296000-memory.dmpFilesize
16KB
-
memory/948-56-0x0000000000400000-0x0000000000A43000-memory.dmpFilesize
6.3MB
-
memory/948-54-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/948-55-0x0000000000292000-0x0000000000296000-memory.dmpFilesize
16KB