Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-09-2023 01:42
Behavioral task
behavioral1
Sample
Stub.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Stub.exe
Resource
win10v2004-20230831-en
General
-
Target
Stub.exe
-
Size
3.8MB
-
MD5
5d422b017137a0060e7de3b1ddff3fbb
-
SHA1
fbc8138cc80dd477ec6bd45ade7bdd27de251260
-
SHA256
c733abcd9c2a5c1734242bc3238dd44e9aaf7e2c01878bebe2751c1b99f9a658
-
SHA512
b5794b69eb87e6e3f0fe19dfe0734a94fb342e27dc3e2936abd052d7cf8f82b672d28a250378b15c3631be6ce60a21643573d372a12917d5cbfa941f17fd4bdc
-
SSDEEP
98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/7mlwXVZ4FB:5+R/eZADUXR
Malware Config
Extracted
bitrat
1.38
smgqnt3eixxksasu.xyz:1234
-
communication_password
30afda4853ef5b1bc36463ba95d84247
-
tor_process
tor
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Ydv4VjsI9owcXnKz.exepid process 2656 Ydv4VjsI9owcXnKz.exe -
Loads dropped DLL 4 IoCs
Processes:
Stub.exepid process 2212 Stub.exe 2212 Stub.exe 2212 Stub.exe 2212 Stub.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Ydv4VjsI9owcXnKz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\checkupdater = "C:\\Users\\Admin\\AppData\\Local\\checkupdater.exe" Ydv4VjsI9owcXnKz.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
Stub.exeaspnet_compiler.exepid process 2212 Stub.exe 2212 Stub.exe 2212 Stub.exe 2212 Stub.exe 2212 Stub.exe 1980 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Ydv4VjsI9owcXnKz.exedescription pid process target process PID 2656 set thread context of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Ydv4VjsI9owcXnKz.exepid process 2656 Ydv4VjsI9owcXnKz.exe 2656 Ydv4VjsI9owcXnKz.exe 2656 Ydv4VjsI9owcXnKz.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Stub.exeYdv4VjsI9owcXnKz.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 2212 Stub.exe Token: SeShutdownPrivilege 2212 Stub.exe Token: SeDebugPrivilege 2656 Ydv4VjsI9owcXnKz.exe Token: SeDebugPrivilege 1980 aspnet_compiler.exe Token: SeShutdownPrivilege 1980 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Stub.exepid process 2212 Stub.exe 2212 Stub.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Stub.exeYdv4VjsI9owcXnKz.exedescription pid process target process PID 2212 wrote to memory of 2656 2212 Stub.exe Ydv4VjsI9owcXnKz.exe PID 2212 wrote to memory of 2656 2212 Stub.exe Ydv4VjsI9owcXnKz.exe PID 2212 wrote to memory of 2656 2212 Stub.exe Ydv4VjsI9owcXnKz.exe PID 2212 wrote to memory of 2656 2212 Stub.exe Ydv4VjsI9owcXnKz.exe PID 2656 wrote to memory of 2132 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 2132 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 2132 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 2132 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe PID 2656 wrote to memory of 1980 2656 Ydv4VjsI9owcXnKz.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exe"C:\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe3⤵PID:2132
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
C:\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
C:\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
\Users\Admin\AppData\Local\Temp\Ydv4VjsI9owcXnKz.exeFilesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
memory/1980-39-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-41-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-50-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-48-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-44-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1980-40-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-38-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-36-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-34-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1980-32-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2212-0-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2212-3-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/2212-1-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/2212-2-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/2212-4-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/2656-27-0x0000000005470000-0x0000000005664000-memory.dmpFilesize
2.0MB
-
memory/2656-25-0x0000000004D70000-0x0000000004F76000-memory.dmpFilesize
2.0MB
-
memory/2656-24-0x0000000000B90000-0x00000000011B4000-memory.dmpFilesize
6.1MB
-
memory/2656-26-0x0000000000720000-0x0000000000760000-memory.dmpFilesize
256KB
-
memory/2656-23-0x0000000072ED0000-0x00000000735BE000-memory.dmpFilesize
6.9MB
-
memory/2656-29-0x0000000072ED0000-0x00000000735BE000-memory.dmpFilesize
6.9MB
-
memory/2656-46-0x0000000072ED0000-0x00000000735BE000-memory.dmpFilesize
6.9MB
-
memory/2656-28-0x0000000000830000-0x000000000087C000-memory.dmpFilesize
304KB
-
memory/2656-30-0x0000000000720000-0x0000000000760000-memory.dmpFilesize
256KB