Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2023 07:06
Static task
static1
Behavioral task
behavioral1
Sample
6b873af536d7895bddbd410be7a6ec28.exe
Resource
win7-20230712-en
General
-
Target
6b873af536d7895bddbd410be7a6ec28.exe
-
Size
3.9MB
-
MD5
6b873af536d7895bddbd410be7a6ec28
-
SHA1
bfd4d81fbd23cb90dabd55cb8fc38c5ae233fcc0
-
SHA256
2530c38358ba6f8bfa74313a790657085a1d8d258b3d5e3515aeb40beb801be0
-
SHA512
0033c8889e3c4ac712370530d17e3877896507383fa13161cae639e2faaab4f40a221a140be5ab967cac8d14dabdd4b60a65cb819375f920b7b9ba61444d685c
-
SSDEEP
98304:bvyXS0f01lcgmusboo+cMP7OfnFdS7NcQc:baZfuVsfs7Ofnr8Nm
Malware Config
Extracted
amadey
3.85
45.9.74.166/b7djSDcPcZ/index.php
45.9.74.141/b7djSDcPcZ/index.php
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6b873af536d7895bddbd410be7a6ec28.exebstyoops.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation 6b873af536d7895bddbd410be7a6ec28.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation bstyoops.exe -
Executes dropped EXE 3 IoCs
Processes:
bstyoops.exebstyoops.exebstyoops.exepid process 4548 bstyoops.exe 4432 bstyoops.exe 2312 bstyoops.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
6b873af536d7895bddbd410be7a6ec28.exepid process 1348 6b873af536d7895bddbd410be7a6ec28.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
6b873af536d7895bddbd410be7a6ec28.exebstyoops.execmd.exedescription pid process target process PID 1348 wrote to memory of 4548 1348 6b873af536d7895bddbd410be7a6ec28.exe bstyoops.exe PID 1348 wrote to memory of 4548 1348 6b873af536d7895bddbd410be7a6ec28.exe bstyoops.exe PID 1348 wrote to memory of 4548 1348 6b873af536d7895bddbd410be7a6ec28.exe bstyoops.exe PID 4548 wrote to memory of 3100 4548 bstyoops.exe schtasks.exe PID 4548 wrote to memory of 3100 4548 bstyoops.exe schtasks.exe PID 4548 wrote to memory of 3100 4548 bstyoops.exe schtasks.exe PID 4548 wrote to memory of 2208 4548 bstyoops.exe cmd.exe PID 4548 wrote to memory of 2208 4548 bstyoops.exe cmd.exe PID 4548 wrote to memory of 2208 4548 bstyoops.exe cmd.exe PID 2208 wrote to memory of 2096 2208 cmd.exe cmd.exe PID 2208 wrote to memory of 2096 2208 cmd.exe cmd.exe PID 2208 wrote to memory of 2096 2208 cmd.exe cmd.exe PID 2208 wrote to memory of 3380 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 3380 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 3380 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 1860 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 1860 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 1860 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 3920 2208 cmd.exe cmd.exe PID 2208 wrote to memory of 3920 2208 cmd.exe cmd.exe PID 2208 wrote to memory of 3920 2208 cmd.exe cmd.exe PID 2208 wrote to memory of 5028 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 5028 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 5028 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 4276 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 4276 2208 cmd.exe cacls.exe PID 2208 wrote to memory of 4276 2208 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b873af536d7895bddbd410be7a6ec28.exe"C:\Users\Admin\AppData\Local\Temp\6b873af536d7895bddbd410be7a6ec28.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:R" /E4⤵
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
3.9MB
MD56b873af536d7895bddbd410be7a6ec28
SHA1bfd4d81fbd23cb90dabd55cb8fc38c5ae233fcc0
SHA2562530c38358ba6f8bfa74313a790657085a1d8d258b3d5e3515aeb40beb801be0
SHA5120033c8889e3c4ac712370530d17e3877896507383fa13161cae639e2faaab4f40a221a140be5ab967cac8d14dabdd4b60a65cb819375f920b7b9ba61444d685c
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
3.9MB
MD56b873af536d7895bddbd410be7a6ec28
SHA1bfd4d81fbd23cb90dabd55cb8fc38c5ae233fcc0
SHA2562530c38358ba6f8bfa74313a790657085a1d8d258b3d5e3515aeb40beb801be0
SHA5120033c8889e3c4ac712370530d17e3877896507383fa13161cae639e2faaab4f40a221a140be5ab967cac8d14dabdd4b60a65cb819375f920b7b9ba61444d685c
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
3.9MB
MD56b873af536d7895bddbd410be7a6ec28
SHA1bfd4d81fbd23cb90dabd55cb8fc38c5ae233fcc0
SHA2562530c38358ba6f8bfa74313a790657085a1d8d258b3d5e3515aeb40beb801be0
SHA5120033c8889e3c4ac712370530d17e3877896507383fa13161cae639e2faaab4f40a221a140be5ab967cac8d14dabdd4b60a65cb819375f920b7b9ba61444d685c
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
3.9MB
MD56b873af536d7895bddbd410be7a6ec28
SHA1bfd4d81fbd23cb90dabd55cb8fc38c5ae233fcc0
SHA2562530c38358ba6f8bfa74313a790657085a1d8d258b3d5e3515aeb40beb801be0
SHA5120033c8889e3c4ac712370530d17e3877896507383fa13161cae639e2faaab4f40a221a140be5ab967cac8d14dabdd4b60a65cb819375f920b7b9ba61444d685c
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
3.9MB
MD56b873af536d7895bddbd410be7a6ec28
SHA1bfd4d81fbd23cb90dabd55cb8fc38c5ae233fcc0
SHA2562530c38358ba6f8bfa74313a790657085a1d8d258b3d5e3515aeb40beb801be0
SHA5120033c8889e3c4ac712370530d17e3877896507383fa13161cae639e2faaab4f40a221a140be5ab967cac8d14dabdd4b60a65cb819375f920b7b9ba61444d685c
-
memory/1348-133-0x0000000000D40000-0x000000000130A000-memory.dmpFilesize
5.8MB
-
memory/2312-157-0x0000000000580000-0x0000000000B4A000-memory.dmpFilesize
5.8MB
-
memory/4432-153-0x0000000000580000-0x0000000000B4A000-memory.dmpFilesize
5.8MB
-
memory/4548-148-0x0000000000580000-0x0000000000B4A000-memory.dmpFilesize
5.8MB