Analysis
-
max time kernel
126s -
max time network
133s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2023 16:03
Static task
static1
General
-
Target
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe
-
Size
7.6MB
-
MD5
18e07c4772a2687ee06a434ffef9572f
-
SHA1
ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
-
SHA256
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
-
SHA512
8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
SSDEEP
196608:eMoIG1kQ7PENK4JQp9ny9MK07ZMCmPSxF:gJB7PGqKMKeBm4F
Malware Config
Extracted
bitrat
1.38
185.225.75.68:3569
-
communication_password
0edcbe7d888380c49e7d1dcf67b6ea6e
-
tor_process
tor
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
state.exestate.exestate.exestate.exepid process 4072 state.exe 4756 state.exe 4992 state.exe 4844 state.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exestate.exestate.exedescription pid process target process PID 3384 set thread context of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 4072 set thread context of 4756 4072 state.exe state.exe PID 4992 set thread context of 4844 4992 state.exe state.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4536 2716 WerFault.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe 4176 4756 WerFault.exe state.exe 2700 4844 WerFault.exe state.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 368 schtasks.exe 4068 schtasks.exe 3836 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.execmd.exestate.execmd.exestate.exedescription pid process target process PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2716 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe PID 3384 wrote to memory of 2232 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 2232 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 2232 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 2564 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 2564 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 2564 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 4332 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 4332 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 3384 wrote to memory of 4332 3384 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe cmd.exe PID 2564 wrote to memory of 368 2564 cmd.exe schtasks.exe PID 2564 wrote to memory of 368 2564 cmd.exe schtasks.exe PID 2564 wrote to memory of 368 2564 cmd.exe schtasks.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4756 4072 state.exe state.exe PID 4072 wrote to memory of 4404 4072 state.exe cmd.exe PID 4072 wrote to memory of 4404 4072 state.exe cmd.exe PID 4072 wrote to memory of 4404 4072 state.exe cmd.exe PID 4072 wrote to memory of 4136 4072 state.exe cmd.exe PID 4072 wrote to memory of 4136 4072 state.exe cmd.exe PID 4072 wrote to memory of 4136 4072 state.exe cmd.exe PID 4072 wrote to memory of 3956 4072 state.exe cmd.exe PID 4072 wrote to memory of 3956 4072 state.exe cmd.exe PID 4072 wrote to memory of 3956 4072 state.exe cmd.exe PID 4136 wrote to memory of 4068 4136 cmd.exe schtasks.exe PID 4136 wrote to memory of 4068 4136 cmd.exe schtasks.exe PID 4136 wrote to memory of 4068 4136 cmd.exe schtasks.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4844 4992 state.exe state.exe PID 4992 wrote to memory of 4964 4992 state.exe cmd.exe PID 4992 wrote to memory of 4964 4992 state.exe cmd.exe PID 4992 wrote to memory of 4964 4992 state.exe cmd.exe PID 4992 wrote to memory of 2240 4992 state.exe cmd.exe PID 4992 wrote to memory of 2240 4992 state.exe cmd.exe PID 4992 wrote to memory of 2240 4992 state.exe cmd.exe PID 4992 wrote to memory of 2760 4992 state.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe"2⤵PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 1963⤵
- Program crash
PID:4536 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"2⤵PID:2232
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵PID:4332
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Creates scheduled task(s)
PID:368
-
C:\Users\Admin\AppData\Roaming\state\state.exeC:\Users\Admin\AppData\Roaming\state\state.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Roaming\state\state.exe"C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵
- Executes dropped EXE
PID:4756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1803⤵
- Program crash
PID:4176 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵PID:3956
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Creates scheduled task(s)
PID:4068 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"2⤵PID:4404
-
C:\Users\Admin\AppData\Roaming\state\state.exeC:\Users\Admin\AppData\Roaming\state\state.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Roaming\state\state.exe"C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 1803⤵
- Program crash
PID:2700 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"2⤵PID:4964
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f2⤵PID:2240
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Creates scheduled task(s)
PID:3836 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\state.exe.logFilesize
520B
MD5807cb75397a3a9fc38e9fb5f8566eb2d
SHA1367e151fab5a5a80e60202d287ae522ea53e2563
SHA2563e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3
SHA51249efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
memory/2716-5-0x0000000000E30000-0x00000000011FE000-memory.dmpFilesize
3.8MB
-
memory/2716-11-0x0000000000E30000-0x00000000011FE000-memory.dmpFilesize
3.8MB
-
memory/2716-15-0x0000000000E30000-0x00000000011FE000-memory.dmpFilesize
3.8MB
-
memory/3384-9-0x0000000073320000-0x0000000073A0E000-memory.dmpFilesize
6.9MB
-
memory/3384-2-0x00000000065B0000-0x0000000006AAE000-memory.dmpFilesize
5.0MB
-
memory/3384-4-0x0000000007AB0000-0x000000000823A000-memory.dmpFilesize
7.5MB
-
memory/3384-1-0x0000000000FA0000-0x000000000173E000-memory.dmpFilesize
7.6MB
-
memory/3384-0-0x0000000073320000-0x0000000073A0E000-memory.dmpFilesize
6.9MB
-
memory/3384-3-0x00000000060A0000-0x00000000060B0000-memory.dmpFilesize
64KB
-
memory/4072-20-0x0000000072640000-0x0000000072D2E000-memory.dmpFilesize
6.9MB
-
memory/4072-21-0x00000000056A0000-0x00000000056B0000-memory.dmpFilesize
64KB
-
memory/4072-30-0x0000000072640000-0x0000000072D2E000-memory.dmpFilesize
6.9MB
-
memory/4756-33-0x0000000001000000-0x00000000013CE000-memory.dmpFilesize
3.8MB
-
memory/4756-28-0x0000000001000000-0x00000000013CE000-memory.dmpFilesize
3.8MB
-
memory/4844-43-0x0000000000DC0000-0x000000000118E000-memory.dmpFilesize
3.8MB
-
memory/4844-48-0x0000000000DC0000-0x000000000118E000-memory.dmpFilesize
3.8MB
-
memory/4992-36-0x00000000726E0000-0x0000000072DCE000-memory.dmpFilesize
6.9MB
-
memory/4992-37-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/4992-47-0x00000000726E0000-0x0000000072DCE000-memory.dmpFilesize
6.9MB