Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
13-09-2023 04:19
General
-
Target
shit.exe
-
Size
5.3MB
-
MD5
daffa640a69186627d8c2334901f1b86
-
SHA1
3c7daeed595df7100ae082c41677178bec1bbaa2
-
SHA256
b280e418cc13c8f1efe66c8c5f4b83e0a544ddbb9d0c460e24d279b93a22c5b3
-
SHA512
1c1022cc5064295d5201f72a1fb2a164bfc5388ef2b8cf0d70f336557f6125c6dc104056dcb5057505243e46446109992199d2a12d9b0a916e3963d1408950cd
-
SSDEEP
98304:f6CJJsPG4aQxuM0HsYspanM2ubkbBVxOnZUNlriiCSqBhYAYSq+h/Vsd/xi8Expe:vgpxl0HsYspanM2ubkbBVxOZymiCSqBo
Malware Config
Extracted
aresloader
http://45.80.69.193
Signatures
-
AresLoader
AresLoader is a loader and downloader written in C++.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\shit.exe"C:\Users\Admin\AppData\Local\Temp\shit.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tzutil /g2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tzutil.exetzutil /g3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5cd31d1bda62e6c59e395bcd54ea7b23f
SHA18be312a526cda4e722942b168514c5a25ad57870
SHA2565c829b1bc9a371935075b06108fa9f9aa1d2f00098db46650d6bea3d58099da0
SHA5124e960c9794b0cbdcc375d4f8844d8ffb5ddbab73fdb1ff96b95859eac41118e48b27c23aa90b9737ca2fa3c87505e12466b966ad2f55d396bbd4ab0efa3a13ea
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
4.8MB
-
Filesize
16KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
6.5MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
256KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
256KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
8KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4.8MB
-
Filesize
2.0MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB