Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2023 19:32
Static task
static1
Behavioral task
behavioral1
Sample
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe
Resource
win7-20230831-en
General
-
Target
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe
-
Size
7.6MB
-
MD5
18e07c4772a2687ee06a434ffef9572f
-
SHA1
ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
-
SHA256
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
-
SHA512
8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
SSDEEP
196608:eMoIG1kQ7PENK4JQp9ny9MK07ZMCmPSxF:gJB7PGqKMKeBm4F
Malware Config
Extracted
bitrat
1.38
185.225.75.68:3569
-
communication_password
0edcbe7d888380c49e7d1dcf67b6ea6e
-
tor_process
tor
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exedescription pid process target process PID 1488 set thread context of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3164 1804 WerFault.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.execmd.exedescription pid process target process PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 1804 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 1488 wrote to memory of 3692 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 3692 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 3692 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 3464 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 3464 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 3464 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 2708 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 2708 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 1488 wrote to memory of 2708 1488 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 3464 wrote to memory of 3360 3464 cmd.exe schtasks.exe PID 3464 wrote to memory of 3360 3464 cmd.exe schtasks.exe PID 3464 wrote to memory of 3360 3464 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"2⤵PID:1804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1883⤵
- Program crash
PID:3164 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"2⤵PID:3692
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵PID:2708
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Creates scheduled task(s)
PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1804 -ip 18041⤵PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-0-0x0000000074EF0000-0x00000000756A0000-memory.dmpFilesize
7.7MB
-
memory/1488-1-0x0000000000FD0000-0x000000000176E000-memory.dmpFilesize
7.6MB
-
memory/1488-2-0x00000000066A0000-0x0000000006C44000-memory.dmpFilesize
5.6MB
-
memory/1488-3-0x00000000060E0000-0x00000000060F0000-memory.dmpFilesize
64KB
-
memory/1488-4-0x0000000007C50000-0x00000000083DA000-memory.dmpFilesize
7.5MB
-
memory/1488-13-0x0000000074EF0000-0x00000000756A0000-memory.dmpFilesize
7.7MB
-
memory/1804-5-0x0000000000D00000-0x00000000010CE000-memory.dmpFilesize
3.8MB
-
memory/1804-9-0x0000000000D00000-0x00000000010CE000-memory.dmpFilesize
3.8MB
-
memory/1804-15-0x0000000000D00000-0x00000000010CE000-memory.dmpFilesize
3.8MB