Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-05-2023 17:46
Static task
static1
Behavioral task
behavioral1
Sample
06721899.exe
Resource
win7-20230220-en
General
-
Target
06721899.exe
-
Size
2.1MB
-
MD5
63e1c29b4c151caf92970fbaf8e0c2a7
-
SHA1
896386e7fd8d86ab3819598f4a549e61b919eee4
-
SHA256
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
-
SHA512
246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
SSDEEP
49152:GCO1NlTK6quyJYbwyi0UZTdA71QxlJOJ56eJwzG6hCF98v7:GJATVdA7WtOOeiv7
Malware Config
Extracted
bitrat
1.38
bitratluckshinjisix130.freeddns.org:7011
-
communication_password
71042e216840c2f1d480e868f387e8db
-
tor_process
tor
Signatures
-
Drops startup file 3 IoCs
Processes:
.exe06721899.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe .exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe 06721899.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe 06721899.exe -
Executes dropped EXE 2 IoCs
Processes:
.exe.exepid process 928 .exe 584 .exe -
Loads dropped DLL 3 IoCs
Processes:
06721899.exe.exepid process 1160 06721899.exe 1160 06721899.exe 928 .exe -
Processes:
resource yara_rule behavioral1/memory/584-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-73-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-75-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-76-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-77-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-78-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-79-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-81-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-83-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-85-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-86-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-87-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-88-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-89-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-90-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-94-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-96-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-97-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-98-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-104-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-109-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-112-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-117-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-120-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-125-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-129-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-133-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/584-138-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
.exepid process 584 .exe 584 .exe 584 .exe 584 .exe 584 .exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
.exedescription pid process target process PID 928 set thread context of 584 928 .exe .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
.exedescription pid process Token: SeDebugPrivilege 584 .exe Token: SeShutdownPrivilege 584 .exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
06721899.exe.exe.exepid process 1160 06721899.exe 928 .exe 584 .exe 584 .exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
06721899.exe.exedescription pid process target process PID 1160 wrote to memory of 928 1160 06721899.exe .exe PID 1160 wrote to memory of 928 1160 06721899.exe .exe PID 1160 wrote to memory of 928 1160 06721899.exe .exe PID 1160 wrote to memory of 928 1160 06721899.exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe PID 928 wrote to memory of 584 928 .exe .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06721899.exe"C:\Users\Admin\AppData\Local\Temp\06721899.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
memory/584-86-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-90-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/584-73-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-75-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-76-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-77-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-78-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-79-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-81-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-83-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-85-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-69-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-87-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-88-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-89-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-91-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/584-92-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/584-94-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-96-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-97-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-98-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-102-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/584-103-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/584-104-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-109-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-112-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-117-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-120-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-125-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-129-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-133-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/584-138-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB