Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-04-2023 20:59
Behavioral task
behavioral1
Sample
1f4b6d549d1c9005fac3532abaaf4408.exe
Resource
win7-20230220-en
General
-
Target
1f4b6d549d1c9005fac3532abaaf4408.exe
-
Size
4.3MB
-
MD5
1f4b6d549d1c9005fac3532abaaf4408
-
SHA1
041b546ac27783ac5fba33897b3f6d539248d0e2
-
SHA256
0d7dc7413dd3f25fcd45de53fc5feebcb3eb5b5517ae1c07469c9072ef9eb9cf
-
SHA512
ac1eb503eb0e7bb15832d17df8b0d8eaa35804b4d4b926e12b94ce40800096255d13be897f7dce2062cde41ff9a73fe427abdfac5e8caa04a3ed86f49254bfd0
-
SSDEEP
49152:k49loyLKmcH0QoS7wT2wcQ2MoVQUbkieBrZJw5ERFtGRCoO4IYB1:KyYASMwEFGIo
Malware Config
Extracted
aurora
185.106.93.237:6378
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Demeon.exepid process 1268 Demeon.exe -
Loads dropped DLL 2 IoCs
Processes:
taskeng.exepid process 1116 taskeng.exe 1116 taskeng.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 HTTP User-Agent header 8 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1728 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1f4b6d549d1c9005fac3532abaaf4408.exepowershell.exetaskeng.exedescription pid process target process PID 2000 wrote to memory of 1728 2000 1f4b6d549d1c9005fac3532abaaf4408.exe powershell.exe PID 2000 wrote to memory of 1728 2000 1f4b6d549d1c9005fac3532abaaf4408.exe powershell.exe PID 2000 wrote to memory of 1728 2000 1f4b6d549d1c9005fac3532abaaf4408.exe powershell.exe PID 1728 wrote to memory of 1868 1728 powershell.exe schtasks.exe PID 1728 wrote to memory of 1868 1728 powershell.exe schtasks.exe PID 1728 wrote to memory of 1868 1728 powershell.exe schtasks.exe PID 1116 wrote to memory of 1268 1116 taskeng.exe Demeon.exe PID 1116 wrote to memory of 1268 1116 taskeng.exe Demeon.exe PID 1116 wrote to memory of 1268 1116 taskeng.exe Demeon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f4b6d549d1c9005fac3532abaaf4408.exe"C:\Users\Admin\AppData\Local\Temp\1f4b6d549d1c9005fac3532abaaf4408.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\Admin\AppData\Roaming\Demeon.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN Soft /TR C:\Users\Admin\AppData\Roaming\Demeon.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {8F776F5A-D3E1-4D50-A581-9210F2785116} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Demeon.exeC:\Users\Admin\AppData\Roaming\Demeon.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Demeon.exeFilesize
4.3MB
MD51f4b6d549d1c9005fac3532abaaf4408
SHA1041b546ac27783ac5fba33897b3f6d539248d0e2
SHA2560d7dc7413dd3f25fcd45de53fc5feebcb3eb5b5517ae1c07469c9072ef9eb9cf
SHA512ac1eb503eb0e7bb15832d17df8b0d8eaa35804b4d4b926e12b94ce40800096255d13be897f7dce2062cde41ff9a73fe427abdfac5e8caa04a3ed86f49254bfd0
-
C:\Users\Admin\AppData\Roaming\Demeon.exeFilesize
4.3MB
MD51f4b6d549d1c9005fac3532abaaf4408
SHA1041b546ac27783ac5fba33897b3f6d539248d0e2
SHA2560d7dc7413dd3f25fcd45de53fc5feebcb3eb5b5517ae1c07469c9072ef9eb9cf
SHA512ac1eb503eb0e7bb15832d17df8b0d8eaa35804b4d4b926e12b94ce40800096255d13be897f7dce2062cde41ff9a73fe427abdfac5e8caa04a3ed86f49254bfd0
-
\Users\Admin\AppData\Roaming\Demeon.exeFilesize
4.3MB
MD51f4b6d549d1c9005fac3532abaaf4408
SHA1041b546ac27783ac5fba33897b3f6d539248d0e2
SHA2560d7dc7413dd3f25fcd45de53fc5feebcb3eb5b5517ae1c07469c9072ef9eb9cf
SHA512ac1eb503eb0e7bb15832d17df8b0d8eaa35804b4d4b926e12b94ce40800096255d13be897f7dce2062cde41ff9a73fe427abdfac5e8caa04a3ed86f49254bfd0
-
\Users\Admin\AppData\Roaming\Demeon.exeFilesize
4.3MB
MD51f4b6d549d1c9005fac3532abaaf4408
SHA1041b546ac27783ac5fba33897b3f6d539248d0e2
SHA2560d7dc7413dd3f25fcd45de53fc5feebcb3eb5b5517ae1c07469c9072ef9eb9cf
SHA512ac1eb503eb0e7bb15832d17df8b0d8eaa35804b4d4b926e12b94ce40800096255d13be897f7dce2062cde41ff9a73fe427abdfac5e8caa04a3ed86f49254bfd0
-
memory/1728-59-0x000000001B460000-0x000000001B742000-memory.dmpFilesize
2.9MB
-
memory/1728-60-0x0000000001F40000-0x0000000001F48000-memory.dmpFilesize
32KB
-
memory/1728-61-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/1728-62-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/1728-63-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB
-
memory/1728-64-0x0000000002870000-0x00000000028F0000-memory.dmpFilesize
512KB