Analysis

  • max time kernel
    112s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2023 16:46

General

  • Target

    4fae4e3df84f89f77df25ed6e9674940.exe

  • Size

    1.8MB

  • MD5

    4fae4e3df84f89f77df25ed6e9674940

  • SHA1

    720372d130c4931506ed0df1ede36dada6803f72

  • SHA256

    cf1de08c2a552617a6e8591a2bd25c72d597854e9564246a700329aa60b08be7

  • SHA512

    08161380459a529918a94acb6acf9d149ba1e4de0a78f90c4db32cabb54a24114d1902da57dbbe49750e61607af667c8ff851201caf42cde83f2391bca6d2c2a

  • SSDEEP

    49152:diszHX1u6cLxfOEPZldmn0TAI5FWQzt+1wBcv+lRA6ZtrPt9gsjGvlaQz:EszHXM6c1dmsAIiQzt+1wmv+lRAorPLq

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    43.155.145.155
  • Port:
    21
  • Username:
    123
  • Password:
    123

Signatures

  • Executes dropped EXE 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4fae4e3df84f89f77df25ed6e9674940.exe
    "C:\Users\Admin\AppData\Local\Temp\4fae4e3df84f89f77df25ed6e9674940.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\ProgramData\test2\wwlib.exe
      C:\ProgramData\test2\wwlib.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4984
    • C:\ProgramData\test2\WINWORD.exe
      C:\ProgramData\test2\WINWORD.exe
      2⤵
      • Executes dropped EXE
      PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\test2\WINWORD.exe
    Filesize

    142KB

    MD5

    4ff52e75438413467ddd272199e70366

    SHA1

    b4f53f04321031ea927dbd4c52acaf3e5fc01b77

    SHA256

    c756d4795d2a54189bc62af7df05dea22edf9c7e113550bac5e75cfdf4481306

    SHA512

    789040e729aae68d0d9ef42918c9b0d289b80a5942d766b40f3b4a6afd48896cc3dbc69b315aaf3419ec9c252212bac38596b66e3908377f7cf754d77cfd19fb

  • C:\ProgramData\test2\WINWORD.exe
    Filesize

    142KB

    MD5

    4ff52e75438413467ddd272199e70366

    SHA1

    b4f53f04321031ea927dbd4c52acaf3e5fc01b77

    SHA256

    c756d4795d2a54189bc62af7df05dea22edf9c7e113550bac5e75cfdf4481306

    SHA512

    789040e729aae68d0d9ef42918c9b0d289b80a5942d766b40f3b4a6afd48896cc3dbc69b315aaf3419ec9c252212bac38596b66e3908377f7cf754d77cfd19fb

  • C:\ProgramData\test2\wwlib.exe
    Filesize

    1.6MB

    MD5

    0c506cd4887583473cce3bb72614aa64

    SHA1

    7af74582a2b916855a5c6b49f32c9449dd06a614

    SHA256

    beb1eda4c7c0ee27f1a17c8a4faae3dba515a45f6b4ef3b63079cc2de77b7112

    SHA512

    3368ac6c7caded66e0a0d6f7e2b163b2e83801108b15bcbadf641031dbdd4a7c304a890ce504d02afb1b02fd5d80fce7f4d5c0279819714ad439fdef66dbeaa7

  • C:\ProgramData\test2\wwlib.exe
    Filesize

    1.6MB

    MD5

    0c506cd4887583473cce3bb72614aa64

    SHA1

    7af74582a2b916855a5c6b49f32c9449dd06a614

    SHA256

    beb1eda4c7c0ee27f1a17c8a4faae3dba515a45f6b4ef3b63079cc2de77b7112

    SHA512

    3368ac6c7caded66e0a0d6f7e2b163b2e83801108b15bcbadf641031dbdd4a7c304a890ce504d02afb1b02fd5d80fce7f4d5c0279819714ad439fdef66dbeaa7

  • memory/1252-135-0x0000000000000000-mapping.dmp
  • memory/1252-138-0x0000000000F30000-0x0000000000F5A000-memory.dmp
    Filesize

    168KB

  • memory/1252-139-0x00007FF9C6AF0000-0x00007FF9C75B1000-memory.dmp
    Filesize

    10.8MB

  • memory/1252-140-0x00007FF9C6AF0000-0x00007FF9C75B1000-memory.dmp
    Filesize

    10.8MB

  • memory/4984-132-0x0000000000000000-mapping.dmp
  • memory/4984-141-0x00000000060D0000-0x000000000616C000-memory.dmp
    Filesize

    624KB

  • memory/4984-142-0x0000000006740000-0x0000000006CE4000-memory.dmp
    Filesize

    5.6MB

  • memory/4984-143-0x0000000006200000-0x0000000006266000-memory.dmp
    Filesize

    408KB