Analysis
-
max time kernel
298s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2023 21:19
Static task
static1
Behavioral task
behavioral1
Sample
stubdownloader.exe
Resource
win10v2004-20230220-en
General
-
Target
stubdownloader.exe
-
Size
230KB
-
MD5
9f78ddf0b80e9d3b735f34c82df45df8
-
SHA1
35412bcc3b08c31baffdaba2aa96a7efea288fa4
-
SHA256
9655ba431831bd59240b44ce2958a0aa20404078da93486cea0b9ce53753a38d
-
SHA512
ae4f08c42c768e7022ea23fbc82abac5412a0dba047f2906c57a8cce8e666ccf6e65007ff1e923a8022e0af3d0070989130b5708ab05d83cae39f72994aa3d5d
-
SSDEEP
3072:KUcvuJEXStOjA7BpQC2mCLsTRozN4rMtH02BhAAH7TNd3XxfyEAg0FujouL1Vwso:omjtOEKKo0MtUEjwEAO3wHes
Malware Config
Extracted
bitrat
1.38
soon-lp.at.ply.gg:17209
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
C:\ProgramData
-
install_file
Bit
-
tor_process
tor
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
stubdownloader.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation stubdownloader.exe -
Executes dropped EXE 1 IoCs
Processes:
JOW3eA2v36fRrIZ9.exepid process 2996 JOW3eA2v36fRrIZ9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
JOW3eA2v36fRrIZ9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bit = "C:\\Users\\Admin\\AppData\\Local\\C:\\ProgramData\\Bit" JOW3eA2v36fRrIZ9.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
JOW3eA2v36fRrIZ9.exepid process 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
JOW3eA2v36fRrIZ9.exepid process 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
JOW3eA2v36fRrIZ9.exedescription pid process Token: SeShutdownPrivilege 2996 JOW3eA2v36fRrIZ9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
JOW3eA2v36fRrIZ9.exepid process 2996 JOW3eA2v36fRrIZ9.exe 2996 JOW3eA2v36fRrIZ9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
stubdownloader.exedescription pid process target process PID 3820 wrote to memory of 2996 3820 stubdownloader.exe JOW3eA2v36fRrIZ9.exe PID 3820 wrote to memory of 2996 3820 stubdownloader.exe JOW3eA2v36fRrIZ9.exe PID 3820 wrote to memory of 2996 3820 stubdownloader.exe JOW3eA2v36fRrIZ9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\stubdownloader.exe"C:\Users\Admin\AppData\Local\Temp\stubdownloader.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JOW3eA2v36fRrIZ9.exe"C:\Users\Admin\AppData\Local\Temp\JOW3eA2v36fRrIZ9.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\JOW3eA2v36fRrIZ9.exeFilesize
3.8MB
MD58ee8f36cfddbb4aeb1388191cfca4e90
SHA1742516898c7ba788f889c2a3438a37a354524577
SHA256a1d460867b08cc04ecf499c53f72acd1ac2ae4a0d28ea72bdc2b7a8a0a99b704
SHA512d84fdac4f0afb9e3e2eb13a14f4753e992ebadc00f1ad87bcf44a7fb41e38b282db7280d8fa9d9c829ce3a314688ca013566d57c3d3ec51c4a3f068e7e65c5b6
-
C:\Users\Admin\AppData\Local\Temp\JOW3eA2v36fRrIZ9.exeFilesize
3.8MB
MD58ee8f36cfddbb4aeb1388191cfca4e90
SHA1742516898c7ba788f889c2a3438a37a354524577
SHA256a1d460867b08cc04ecf499c53f72acd1ac2ae4a0d28ea72bdc2b7a8a0a99b704
SHA512d84fdac4f0afb9e3e2eb13a14f4753e992ebadc00f1ad87bcf44a7fb41e38b282db7280d8fa9d9c829ce3a314688ca013566d57c3d3ec51c4a3f068e7e65c5b6
-
C:\Users\Admin\AppData\Local\Temp\JOW3eA2v36fRrIZ9.exeFilesize
3.8MB
MD58ee8f36cfddbb4aeb1388191cfca4e90
SHA1742516898c7ba788f889c2a3438a37a354524577
SHA256a1d460867b08cc04ecf499c53f72acd1ac2ae4a0d28ea72bdc2b7a8a0a99b704
SHA512d84fdac4f0afb9e3e2eb13a14f4753e992ebadc00f1ad87bcf44a7fb41e38b282db7280d8fa9d9c829ce3a314688ca013566d57c3d3ec51c4a3f068e7e65c5b6
-
memory/2996-152-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2996-153-0x0000000074240000-0x0000000074279000-memory.dmpFilesize
228KB
-
memory/2996-154-0x0000000073F00000-0x0000000073F39000-memory.dmpFilesize
228KB
-
memory/2996-155-0x0000000074240000-0x0000000074279000-memory.dmpFilesize
228KB
-
memory/2996-156-0x0000000073F00000-0x0000000073F39000-memory.dmpFilesize
228KB
-
memory/2996-157-0x0000000072E20000-0x0000000072E59000-memory.dmpFilesize
228KB
-
memory/2996-158-0x0000000072E20000-0x0000000072E59000-memory.dmpFilesize
228KB
-
memory/2996-159-0x0000000072E20000-0x0000000072E59000-memory.dmpFilesize
228KB