Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2023 01:06
Behavioral task
behavioral1
Sample
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe
Resource
win7-20230712-en
General
-
Target
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe
-
Size
6.5MB
-
MD5
92031e02bc46932ace98fb8b54f261f4
-
SHA1
e4414033fedbaa9cb96660558748f36b5c0ae9d3
-
SHA256
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
-
SHA512
9407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
SSDEEP
98304:FgTOuxyekXIG+AM/M8MqPtPGp/6qWXCT5QYux3bWJvAi9nzDMeEuJW2wq73:l4KM/BMqPt8/lWSDucUPqr
Malware Config
Extracted
amadey
3.85
45.9.74.166/b7djSDcPcZ/index.php
45.9.74.141/b7djSDcPcZ/index.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bstyoops.exe15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation bstyoops.exe Key value queried \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe -
Executes dropped EXE 3 IoCs
Processes:
bstyoops.exebstyoops.exebstyoops.exepid process 3592 bstyoops.exe 4496 bstyoops.exe 1460 bstyoops.exe -
Processes:
resource yara_rule behavioral2/memory/4996-135-0x0000000000C50000-0x00000000016E9000-memory.dmp vmprotect behavioral2/memory/4996-134-0x0000000000C50000-0x00000000016E9000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral2/memory/4996-151-0x0000000000C50000-0x00000000016E9000-memory.dmp vmprotect behavioral2/memory/3592-154-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect behavioral2/memory/3592-153-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect behavioral2/memory/3592-157-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral2/memory/4496-159-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect behavioral2/memory/4496-162-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect behavioral2/memory/4496-165-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral2/memory/1460-169-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect behavioral2/memory/1460-168-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect behavioral2/memory/1460-172-0x0000000000490000-0x0000000000F29000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exebstyoops.exebstyoops.exebstyoops.exepid process 4996 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe 4996 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe 3592 bstyoops.exe 3592 bstyoops.exe 4496 bstyoops.exe 4496 bstyoops.exe 1460 bstyoops.exe 1460 bstyoops.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exepid process 4996 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exebstyoops.execmd.exedescription pid process target process PID 4996 wrote to memory of 3592 4996 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 4996 wrote to memory of 3592 4996 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 4996 wrote to memory of 3592 4996 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 3592 wrote to memory of 3048 3592 bstyoops.exe schtasks.exe PID 3592 wrote to memory of 3048 3592 bstyoops.exe schtasks.exe PID 3592 wrote to memory of 3048 3592 bstyoops.exe schtasks.exe PID 3592 wrote to memory of 2688 3592 bstyoops.exe cmd.exe PID 3592 wrote to memory of 2688 3592 bstyoops.exe cmd.exe PID 3592 wrote to memory of 2688 3592 bstyoops.exe cmd.exe PID 2688 wrote to memory of 1420 2688 cmd.exe cmd.exe PID 2688 wrote to memory of 1420 2688 cmd.exe cmd.exe PID 2688 wrote to memory of 1420 2688 cmd.exe cmd.exe PID 2688 wrote to memory of 3068 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 3068 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 3068 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 4820 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 4820 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 4820 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 692 2688 cmd.exe cmd.exe PID 2688 wrote to memory of 692 2688 cmd.exe cmd.exe PID 2688 wrote to memory of 692 2688 cmd.exe cmd.exe PID 2688 wrote to memory of 4368 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 4368 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 4368 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 1604 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 1604 2688 cmd.exe cacls.exe PID 2688 wrote to memory of 1604 2688 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe"C:\Users\Admin\AppData\Local\Temp\15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:R" /E4⤵
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
memory/1460-172-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/1460-168-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/1460-169-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/1460-167-0x0000000002F30000-0x0000000002F31000-memory.dmpFilesize
4KB
-
memory/3592-157-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/3592-153-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/3592-154-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/3592-152-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/4496-159-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/4496-160-0x0000000001490000-0x0000000001491000-memory.dmpFilesize
4KB
-
memory/4496-162-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/4496-165-0x0000000000490000-0x0000000000F29000-memory.dmpFilesize
10.6MB
-
memory/4996-135-0x0000000000C50000-0x00000000016E9000-memory.dmpFilesize
10.6MB
-
memory/4996-151-0x0000000000C50000-0x00000000016E9000-memory.dmpFilesize
10.6MB
-
memory/4996-133-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/4996-134-0x0000000000C50000-0x00000000016E9000-memory.dmpFilesize
10.6MB