Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 14:00
Behavioral task
behavioral1
Sample
e38edcf41b7b13dc8837e030774cf083.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
e38edcf41b7b13dc8837e030774cf083.exe
-
Size
9.6MB
-
MD5
e38edcf41b7b13dc8837e030774cf083
-
SHA1
1ed5f18fbc105fd177129f594d63e3297654acff
-
SHA256
9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc
-
SHA512
17021db0c40c5068c1df61e3682cd967fec74a76e661d5967b3950d2a0f2a3a64ea15abcfd21b89223fb541d3561172a0dbdcc2a63694996518e0fde8ced1080
-
SSDEEP
196608:JGujuxvOMsHXVCFzaixl/CcHsjGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG:JXdP3VC9CcMjGGGGGGGGGGGGGGGGGGGi
Malware Config
Extracted
Family
aurora
C2
94.142.138.215:8081
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e38edcf41b7b13dc8837e030774cf083.exedescription pid process target process PID 1244 set thread context of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e38edcf41b7b13dc8837e030774cf083.exedescription pid process Token: SeDebugPrivilege 1244 e38edcf41b7b13dc8837e030774cf083.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e38edcf41b7b13dc8837e030774cf083.exedescription pid process target process PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe PID 1244 wrote to memory of 384 1244 e38edcf41b7b13dc8837e030774cf083.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e38edcf41b7b13dc8837e030774cf083.exe"C:\Users\Admin\AppData\Local\Temp\e38edcf41b7b13dc8837e030774cf083.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-64-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-72-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-62-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-73-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-58-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-59-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-60-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-63-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-74-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-71-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-61-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-66-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/384-68-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-69-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/384-70-0x0000000000400000-0x0000000000747000-memory.dmpFilesize
3.3MB
-
memory/1244-56-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1244-54-0x0000000000B90000-0x000000000153A000-memory.dmpFilesize
9.7MB
-
memory/1244-57-0x000000001BE40000-0x000000001C0C0000-memory.dmpFilesize
2.5MB
-
memory/1244-55-0x000000001B7A0000-0x000000001B820000-memory.dmpFilesize
512KB