Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
84499558c48c4fdebac20cab68253aa7.exe
Resource
win7-20230220-en
General
-
Target
84499558c48c4fdebac20cab68253aa7.exe
-
Size
228KB
-
MD5
84499558c48c4fdebac20cab68253aa7
-
SHA1
d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce
-
SHA256
ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c
-
SHA512
00ad7c29108eb787d0283bb6a6c2955ff3b4a64254d03767c1c21e8bf3a1e14149958c9de8f4fd2f6489972b4573b07abc18a3bc2e96cba5fe2d4852d204d65a
-
SSDEEP
3072:psLU9af5Y43YGpnzljr0E8aj8G9Ku+oukzuhWkiWBkOuRGK:GL2O3YGpnzlFBj59zukihIpjcK
Malware Config
Extracted
systembc
109.205.214.18:443
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1392 ssfsb.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\ssfsb.job 84499558c48c4fdebac20cab68253aa7.exe File opened for modification C:\Windows\Tasks\ssfsb.job 84499558c48c4fdebac20cab68253aa7.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5056 2976 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2976 84499558c48c4fdebac20cab68253aa7.exe 2976 84499558c48c4fdebac20cab68253aa7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84499558c48c4fdebac20cab68253aa7.exe"C:\Users\Admin\AppData\Local\Temp\84499558c48c4fdebac20cab68253aa7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 9602⤵
- Program crash
PID:5056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2976 -ip 29761⤵PID:3884
-
C:\ProgramData\xofjvbf\ssfsb.exeC:\ProgramData\xofjvbf\ssfsb.exe start1⤵
- Executes dropped EXE
PID:1392
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD584499558c48c4fdebac20cab68253aa7
SHA1d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce
SHA256ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c
SHA51200ad7c29108eb787d0283bb6a6c2955ff3b4a64254d03767c1c21e8bf3a1e14149958c9de8f4fd2f6489972b4573b07abc18a3bc2e96cba5fe2d4852d204d65a
-
Filesize
228KB
MD584499558c48c4fdebac20cab68253aa7
SHA1d4518c621d32ebc483a8f0761cf6ed0fe3c7b8ce
SHA256ca958072c2483f5cfab83972b3e5a25a163eed2d0d6df7d310ddf200a6fec53c
SHA51200ad7c29108eb787d0283bb6a6c2955ff3b4a64254d03767c1c21e8bf3a1e14149958c9de8f4fd2f6489972b4573b07abc18a3bc2e96cba5fe2d4852d204d65a