Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-05-2023 18:57
Static task
static1
Behavioral task
behavioral1
Sample
M7R79569.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
M7R79569.exe
Resource
win10v2004-20230221-en
General
-
Target
M7R79569.exe
-
Size
348KB
-
MD5
8c6810ccbf8b94ad18edabe648ffd504
-
SHA1
9f3770c114956fb31d04ec3020fe4da03a8ac2d4
-
SHA256
b8f848f137a23fe046b4701a67d07c8e7e1a8fdb066f318424caede7a1e69530
-
SHA512
7bf15296bbdce5aee540b9a6738c65a3f54b773f6aa50b27a98ad8c33544ff60625f650c8bb90fa17a0c60e8b799a88536f5609b41a94784fcb283b810f0b7b9
-
SSDEEP
6144:UMLeUFXXI8t9K/uN6qmhCaHA5DZNyI187cMsU5wgsbZv+:JesY8t9KQ6q9WAZNVOAzzr+
Malware Config
Extracted
zloader
CanadaLoads
Spam
https://23d8s23hs89j239sj23.com/jbYm9bt/NlGkb4ivk.php
https://3reh8rd23js9.com/jbYm9bt/NlGkb4ivk.php
https://4f394j89d3j4d89j34d.com/jbYm9bt/NlGkb4ivk.php
https://d823hrd9239sdj2.com/jbYm9bt/NlGkb4ivk.php
https://js823hs23js.com/jbYm9bt/NlGkb4ivk.php
https://oidjweidj34rd3.com/jbYm9bt/NlGkb4ivk.php
https://qwd8s3j8s23h8s.com/jbYm9bt/NlGkb4ivk.php
https://s28hs823hs823js.com/jbYm9bt/NlGkb4ivk.php
https://wd23h8qsh8qhs823qs.com/jbYm9bt/NlGkb4ivk.php
-
build_id
34
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Igvesa = "C:\\Users\\Admin\\AppData\\Roaming\\Peotb\\comyutu.exe" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2040 set thread context of 2004 2040 M7R79569.exe 28 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 2004 msiexec.exe Token: SeSecurityPrivilege 2004 msiexec.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28 PID 2040 wrote to memory of 2004 2040 M7R79569.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\M7R79569.exe"C:\Users\Admin\AppData\Local\Temp\M7R79569.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2004
-