Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 17:11
Static task
static1
Behavioral task
behavioral1
Sample
FAVOR DE RECTIFICAR.scr.exe
Resource
win7-20230220-en
General
-
Target
FAVOR DE RECTIFICAR.scr.exe
-
Size
2.1MB
-
MD5
63e1c29b4c151caf92970fbaf8e0c2a7
-
SHA1
896386e7fd8d86ab3819598f4a549e61b919eee4
-
SHA256
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
-
SHA512
246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
SSDEEP
49152:GCO1NlTK6quyJYbwyi0UZTdA71QxlJOJ56eJwzG6hCF98v7:GJATVdA7WtOOeiv7
Malware Config
Extracted
bitrat
1.38
bitratluckshinjisix130.freeddns.org:7011
-
communication_password
71042e216840c2f1d480e868f387e8db
-
tor_process
tor
Signatures
-
Drops startup file 3 IoCs
Processes:
FAVOR DE RECTIFICAR.scr.exe.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe FAVOR DE RECTIFICAR.scr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe .exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe FAVOR DE RECTIFICAR.scr.exe -
Executes dropped EXE 2 IoCs
Processes:
.exe.exepid process 2140 .exe 388 .exe -
Processes:
resource yara_rule behavioral2/memory/388-142-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-144-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-146-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-150-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-151-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-152-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-153-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-154-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-155-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-156-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-157-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-158-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-160-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-161-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-162-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-164-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-165-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-166-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-172-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-177-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-182-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-187-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-192-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-197-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-200-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-207-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/388-212-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
.exepid process 388 .exe 388 .exe 388 .exe 388 .exe 388 .exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
.exedescription pid process target process PID 2140 set thread context of 388 2140 .exe .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
.exedescription pid process Token: SeShutdownPrivilege 388 .exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
FAVOR DE RECTIFICAR.scr.exe.exe.exepid process 2232 FAVOR DE RECTIFICAR.scr.exe 2140 .exe 388 .exe 388 .exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
FAVOR DE RECTIFICAR.scr.exe.exedescription pid process target process PID 2232 wrote to memory of 2140 2232 FAVOR DE RECTIFICAR.scr.exe .exe PID 2232 wrote to memory of 2140 2232 FAVOR DE RECTIFICAR.scr.exe .exe PID 2232 wrote to memory of 2140 2232 FAVOR DE RECTIFICAR.scr.exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe PID 2140 wrote to memory of 388 2140 .exe .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FAVOR DE RECTIFICAR.scr.exe"C:\Users\Admin\AppData\Local\Temp\FAVOR DE RECTIFICAR.scr.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
memory/388-159-0x00000000753B0000-0x00000000753E9000-memory.dmpFilesize
228KB
-
memory/388-151-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-146-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-160-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-149-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB
-
memory/388-150-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-161-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-152-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-153-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-154-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-155-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-156-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-162-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-158-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-142-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-144-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-157-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-164-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-165-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-166-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-172-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-177-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-182-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-187-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-192-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-197-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-200-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-202-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB
-
memory/388-205-0x00000000753B0000-0x00000000753E9000-memory.dmpFilesize
228KB
-
memory/388-207-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/388-212-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB