Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2023 00:44
Behavioral task
behavioral1
Sample
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe
Resource
win7-20230712-en
General
-
Target
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe
-
Size
6.5MB
-
MD5
92031e02bc46932ace98fb8b54f261f4
-
SHA1
e4414033fedbaa9cb96660558748f36b5c0ae9d3
-
SHA256
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
-
SHA512
9407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
SSDEEP
98304:FgTOuxyekXIG+AM/M8MqPtPGp/6qWXCT5QYux3bWJvAi9nzDMeEuJW2wq73:l4KM/BMqPt8/lWSDucUPqr
Malware Config
Extracted
amadey
3.85
45.9.74.166/b7djSDcPcZ/index.php
45.9.74.141/b7djSDcPcZ/index.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
bstyoops.exebstyoops.exebstyoops.exepid process 4680 bstyoops.exe 2828 bstyoops.exe 4424 bstyoops.exe -
Processes:
resource yara_rule behavioral2/memory/4300-135-0x00000000000A0000-0x0000000000B39000-memory.dmp vmprotect behavioral2/memory/4300-134-0x00000000000A0000-0x0000000000B39000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral2/memory/4300-151-0x00000000000A0000-0x0000000000B39000-memory.dmp vmprotect behavioral2/memory/4680-153-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect behavioral2/memory/4680-155-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect behavioral2/memory/4680-158-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral2/memory/2828-162-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect behavioral2/memory/2828-161-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect behavioral2/memory/2828-165-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe vmprotect behavioral2/memory/4424-169-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect behavioral2/memory/4424-168-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect behavioral2/memory/4424-172-0x0000000000720000-0x00000000011B9000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exebstyoops.exebstyoops.exebstyoops.exepid process 4300 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe 4300 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe 4680 bstyoops.exe 4680 bstyoops.exe 2828 bstyoops.exe 2828 bstyoops.exe 4424 bstyoops.exe 4424 bstyoops.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exepid process 4300 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exebstyoops.execmd.exedescription pid process target process PID 4300 wrote to memory of 4680 4300 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 4300 wrote to memory of 4680 4300 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 4300 wrote to memory of 4680 4300 15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe bstyoops.exe PID 4680 wrote to memory of 4792 4680 bstyoops.exe schtasks.exe PID 4680 wrote to memory of 4792 4680 bstyoops.exe schtasks.exe PID 4680 wrote to memory of 4792 4680 bstyoops.exe schtasks.exe PID 4680 wrote to memory of 420 4680 bstyoops.exe cmd.exe PID 4680 wrote to memory of 420 4680 bstyoops.exe cmd.exe PID 4680 wrote to memory of 420 4680 bstyoops.exe cmd.exe PID 420 wrote to memory of 2688 420 cmd.exe cmd.exe PID 420 wrote to memory of 2688 420 cmd.exe cmd.exe PID 420 wrote to memory of 2688 420 cmd.exe cmd.exe PID 420 wrote to memory of 4428 420 cmd.exe cacls.exe PID 420 wrote to memory of 4428 420 cmd.exe cacls.exe PID 420 wrote to memory of 4428 420 cmd.exe cacls.exe PID 420 wrote to memory of 3868 420 cmd.exe cacls.exe PID 420 wrote to memory of 3868 420 cmd.exe cacls.exe PID 420 wrote to memory of 3868 420 cmd.exe cacls.exe PID 420 wrote to memory of 4032 420 cmd.exe cmd.exe PID 420 wrote to memory of 4032 420 cmd.exe cmd.exe PID 420 wrote to memory of 4032 420 cmd.exe cmd.exe PID 420 wrote to memory of 4540 420 cmd.exe cacls.exe PID 420 wrote to memory of 4540 420 cmd.exe cacls.exe PID 420 wrote to memory of 4540 420 cmd.exe cacls.exe PID 420 wrote to memory of 2944 420 cmd.exe cacls.exe PID 420 wrote to memory of 2944 420 cmd.exe cacls.exe PID 420 wrote to memory of 2944 420 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe"C:\Users\Admin\AppData\Local\Temp\15767660942cc7c75ff800cfeb1b759f8194d3a1332a9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN bstyoops.exe /TR "C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe" /F3⤵
- Creates scheduled task(s)
PID:4792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "bstyoops.exe" /P "Admin:N"&&CACLS "bstyoops.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c2868ed41c" /P "Admin:N"&&CACLS "..\c2868ed41c" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2688
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:N"4⤵PID:4428
-
C:\Windows\SysWOW64\cacls.exeCACLS "bstyoops.exe" /P "Admin:R" /E4⤵PID:3868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4032
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:N"4⤵PID:4540
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c2868ed41c" /P "Admin:R" /E4⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2828
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeC:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
C:\Users\Admin\AppData\Local\Temp\c2868ed41c\bstyoops.exeFilesize
6.5MB
MD592031e02bc46932ace98fb8b54f261f4
SHA1e4414033fedbaa9cb96660558748f36b5c0ae9d3
SHA25615767660942cc7c75ff800cfeb1b759f8194d3a1332a9fb024abdf4b86cfc9df
SHA5129407bb053c91482fa5426f3d11f5b271f42556905ba49ba0f50fd1f147c24d555086f5ffd11f36187a15ed2d9abc0c45e16c92c0b30f87849ad39a64186c1195
-
memory/2828-165-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/2828-160-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/2828-161-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/2828-162-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4300-133-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB
-
memory/4300-134-0x00000000000A0000-0x0000000000B39000-memory.dmpFilesize
10.6MB
-
memory/4300-151-0x00000000000A0000-0x0000000000B39000-memory.dmpFilesize
10.6MB
-
memory/4300-135-0x00000000000A0000-0x0000000000B39000-memory.dmpFilesize
10.6MB
-
memory/4424-167-0x0000000001A20000-0x0000000001A21000-memory.dmpFilesize
4KB
-
memory/4424-169-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4424-168-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4424-172-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4680-158-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4680-155-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4680-153-0x0000000000720000-0x00000000011B9000-memory.dmpFilesize
10.6MB
-
memory/4680-152-0x0000000001620000-0x0000000001621000-memory.dmpFilesize
4KB