Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe
Resource
win7-20230220-en
General
-
Target
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe
-
Size
3.8MB
-
MD5
d07b7112b39c9eee7eaeba1adb099543
-
SHA1
1df70cc161540228240e1dde290ac2f5efcfbb0c
-
SHA256
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
-
SHA512
9f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
SSDEEP
98304:cCtEONaf1kMdpRfZJDRJwdaUNa8gPgEICG6x098gJ2uCB9Ml:RE0UkkHRJuNawLCG6x+8gJFm
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tewu.exetewu.exepid process 1668 tewu.exe 1724 tewu.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 848 vbc.exe 848 vbc.exe 848 vbc.exe 848 vbc.exe 848 vbc.exe 1660 vbc.exe 580 vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exetewu.exetewu.exedescription pid process target process PID 1320 set thread context of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1668 set thread context of 1660 1668 tewu.exe vbc.exe PID 1724 set thread context of 580 1724 tewu.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2004 schtasks.exe 584 schtasks.exe 1584 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 848 vbc.exe Token: SeShutdownPrivilege 848 vbc.exe Token: SeDebugPrivilege 1660 vbc.exe Token: SeShutdownPrivilege 1660 vbc.exe Token: SeDebugPrivilege 580 vbc.exe Token: SeShutdownPrivilege 580 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vbc.exepid process 848 vbc.exe 848 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.execmd.exetaskeng.exetewu.execmd.exedescription pid process target process PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 848 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe vbc.exe PID 1320 wrote to memory of 1948 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1948 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1948 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1948 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1040 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1040 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1040 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 1040 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 996 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 996 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 996 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1320 wrote to memory of 996 1320 1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe cmd.exe PID 1040 wrote to memory of 584 1040 cmd.exe schtasks.exe PID 1040 wrote to memory of 584 1040 cmd.exe schtasks.exe PID 1040 wrote to memory of 584 1040 cmd.exe schtasks.exe PID 1040 wrote to memory of 584 1040 cmd.exe schtasks.exe PID 2036 wrote to memory of 1668 2036 taskeng.exe tewu.exe PID 2036 wrote to memory of 1668 2036 taskeng.exe tewu.exe PID 2036 wrote to memory of 1668 2036 taskeng.exe tewu.exe PID 2036 wrote to memory of 1668 2036 taskeng.exe tewu.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1660 1668 tewu.exe vbc.exe PID 1668 wrote to memory of 1312 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1312 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1312 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1312 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 940 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 940 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 940 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 940 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1816 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1816 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1816 1668 tewu.exe cmd.exe PID 1668 wrote to memory of 1816 1668 tewu.exe cmd.exe PID 940 wrote to memory of 1584 940 cmd.exe schtasks.exe PID 940 wrote to memory of 1584 940 cmd.exe schtasks.exe PID 940 wrote to memory of 1584 940 cmd.exe schtasks.exe PID 940 wrote to memory of 1584 940 cmd.exe schtasks.exe PID 2036 wrote to memory of 1724 2036 taskeng.exe tewu.exe PID 2036 wrote to memory of 1724 2036 taskeng.exe tewu.exe PID 2036 wrote to memory of 1724 2036 taskeng.exe tewu.exe PID 2036 wrote to memory of 1724 2036 taskeng.exe tewu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe"C:\Users\Admin\AppData\Local\Temp\1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\1c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {E7486573-CB93-4D1D-BED5-B162C628DE79} S-1-5-21-2647223082-2067913677-935928954-1000:BPOQNXYB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeC:\Users\Admin\AppData\Roaming\tewu\tewu.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeC:\Users\Admin\AppData\Roaming\tewu\tewu.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\tewu"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\tewu\tewu.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe" "C:\Users\Admin\AppData\Roaming\tewu\tewu.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeFilesize
3.8MB
MD5d07b7112b39c9eee7eaeba1adb099543
SHA11df70cc161540228240e1dde290ac2f5efcfbb0c
SHA2561c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA5129f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeFilesize
3.8MB
MD5d07b7112b39c9eee7eaeba1adb099543
SHA11df70cc161540228240e1dde290ac2f5efcfbb0c
SHA2561c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA5129f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
C:\Users\Admin\AppData\Roaming\tewu\tewu.exeFilesize
3.8MB
MD5d07b7112b39c9eee7eaeba1adb099543
SHA11df70cc161540228240e1dde290ac2f5efcfbb0c
SHA2561c0493090eb306714a26e5a30404947c325dc75410adf4ee4ea18ea159302b9a
SHA5129f82564e59b49e503de3aad4b7a28a163b3de543a807522c48c5b6f3a005cb38b37e99fab6865e0e064be9c1cf6e2cbec616e7cbb2218ea9f1fbd2015ef9e135
-
memory/580-155-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/580-146-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-86-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-127-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-61-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-62-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/848-63-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-67-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-68-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-70-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-71-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-73-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-74-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-75-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-76-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-77-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-78-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-79-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-80-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/848-81-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/848-82-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-84-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-85-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-55-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-56-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-60-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-94-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/848-92-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-93-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-90-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-95-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-58-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-88-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-57-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-129-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-113-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-87-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-117-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-119-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-121-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-123-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/848-125-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1320-54-0x0000000000DA0000-0x0000000001174000-memory.dmpFilesize
3.8MB
-
memory/1660-116-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1660-112-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1668-102-0x0000000000CC0000-0x0000000000D00000-memory.dmpFilesize
256KB
-
memory/1668-99-0x0000000001080000-0x0000000001454000-memory.dmpFilesize
3.8MB
-
memory/1724-134-0x0000000001080000-0x0000000001454000-memory.dmpFilesize
3.8MB