Analysis
-
max time kernel
290s -
max time network
245s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
22-07-2023 22:12
Static task
static1
Behavioral task
behavioral1
Sample
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
Resource
win10-20230703-en
General
-
Target
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
-
Size
4.1MB
-
MD5
bfaf9b1bbefa0dcf2333437f69b1ab98
-
SHA1
d1f5eb29d46d6480d28460dccc5158eb5a006336
-
SHA256
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c
-
SHA512
f4ef55c35136152837cd366c1dcecbb1046d5ca0ff74c88367c9cdb594a8fe106d68dec30793c5979d3da5940e1858f25dca962af65a0e8a9d426eaa2099845f
-
SSDEEP
6144:sB5f3YwKrMducTng1RxdBNE8ZOoXzeprQoXwg4kVUm+vL1kXwT/vEVqlKh:If3zKrMduNndr3zDepGkVwvhHXEVA0
Malware Config
Extracted
systembc
91.103.252.89:4317
91.103.252.57:4317
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4175128012-676912335-1083716439-1000\Software\Microsoft\Windows\CurrentVersion\Run 40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4175128012-676912335-1083716439-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe'\"" 40293bf72b77c294924a419c1bef6a227ba280a7610ef7276ca0a4f31e2d3b6c.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3676-117-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/3676-118-0x0000000000400000-0x000000000081F000-memory.dmpFilesize
4.1MB
-
memory/3676-119-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/3676-120-0x0000000004340000-0x00000000046F8000-memory.dmpFilesize
3.7MB
-
memory/3676-121-0x0000000000400000-0x000000000081F000-memory.dmpFilesize
4.1MB