Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2023 01:46
Static task
static1
Behavioral task
behavioral1
Sample
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe
Resource
win7-20230220-en
General
-
Target
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe
-
Size
2.1MB
-
MD5
63e1c29b4c151caf92970fbaf8e0c2a7
-
SHA1
896386e7fd8d86ab3819598f4a549e61b919eee4
-
SHA256
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
-
SHA512
246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
SSDEEP
49152:GCO1NlTK6quyJYbwyi0UZTdA71QxlJOJ56eJwzG6hCF98v7:GJATVdA7WtOOeiv7
Malware Config
Extracted
bitrat
1.38
bitratluckshinjisix130.freeddns.org:7011
-
communication_password
71042e216840c2f1d480e868f387e8db
-
tor_process
tor
Signatures
-
Drops startup file 3 IoCs
Processes:
.exe719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe .exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe 719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe 719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe -
Executes dropped EXE 2 IoCs
Processes:
.exe.exepid process 4304 .exe 1728 .exe -
Processes:
resource yara_rule behavioral2/memory/1728-142-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-144-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-146-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-150-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-151-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-153-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-152-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-154-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-155-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-156-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-157-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-158-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-159-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-161-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-162-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-163-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-164-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-168-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-173-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-178-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-183-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-188-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-193-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-198-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-205-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/1728-210-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
.exepid process 1728 .exe 1728 .exe 1728 .exe 1728 .exe 1728 .exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
.exedescription pid process target process PID 4304 set thread context of 1728 4304 .exe .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
.exedescription pid process Token: SeShutdownPrivilege 1728 .exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe.exe.exepid process 4152 719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe 4304 .exe 1728 .exe 1728 .exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe.exedescription pid process target process PID 4152 wrote to memory of 4304 4152 719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe .exe PID 4152 wrote to memory of 4304 4152 719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe .exe PID 4152 wrote to memory of 4304 4152 719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe PID 4304 wrote to memory of 1728 4304 .exe .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe"C:\Users\Admin\AppData\Local\Temp\719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeFilesize
2.1MB
MD563e1c29b4c151caf92970fbaf8e0c2a7
SHA1896386e7fd8d86ab3819598f4a549e61b919eee4
SHA256719548921d3a99d8bf31d9c2d543803c0c39a620a8386f8ac557b7ebe5d024d2
SHA512246d12288e1426b0aa0b53c69efa9fa80781ffdc4394b761ea35f4dae19618b20d7d80402d3edd5d258acbe69c6f8e4640d3d21ba460653383e1408d8d3d9a75
-
memory/1728-157-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-204-0x00000000749A0000-0x00000000749D9000-memory.dmpFilesize
228KB
-
memory/1728-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-146-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-149-0x0000000074620000-0x0000000074659000-memory.dmpFilesize
228KB
-
memory/1728-160-0x00000000749A0000-0x00000000749D9000-memory.dmpFilesize
228KB
-
memory/1728-151-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-153-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-152-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-154-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-155-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-156-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-142-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-210-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-144-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-150-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-161-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-162-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-163-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-164-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-168-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-173-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-178-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-183-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-188-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-193-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-198-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-201-0x0000000074620000-0x0000000074659000-memory.dmpFilesize
228KB
-
memory/1728-159-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-205-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1728-158-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB