Analysis
-
max time kernel
29s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 00:43
Static task
static1
Behavioral task
behavioral1
Sample
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe
Resource
win7-20230831-en
General
-
Target
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe
-
Size
7.6MB
-
MD5
18e07c4772a2687ee06a434ffef9572f
-
SHA1
ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
-
SHA256
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
-
SHA512
8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
SSDEEP
196608:eMoIG1kQ7PENK4JQp9ny9MK07ZMCmPSxF:gJB7PGqKMKeBm4F
Malware Config
Extracted
bitrat
1.38
185.225.75.68:3569
-
communication_password
0edcbe7d888380c49e7d1dcf67b6ea6e
-
tor_process
tor
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
state.exepid process 2660 state.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exepid process 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exedescription pid process target process PID 4696 set thread context of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exedescription pid process Token: SeShutdownPrivilege 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exepid process 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 1864 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.execmd.exedescription pid process target process PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 1864 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 4696 wrote to memory of 4940 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 4940 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 4940 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 4648 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 4648 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 4648 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 2592 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 2592 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4696 wrote to memory of 2592 4696 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 4648 wrote to memory of 4508 4648 cmd.exe schtasks.exe PID 4648 wrote to memory of 4508 4648 cmd.exe schtasks.exe PID 4648 wrote to memory of 4508 4648 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵PID:2592
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Creates scheduled task(s)
PID:4508 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"2⤵PID:4940
-
C:\Users\Admin\AppData\Roaming\state\state.exeC:\Users\Admin\AppData\Roaming\state\state.exe1⤵
- Executes dropped EXE
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
2.1MB
MD573ffc8d68059917200ca047e613140e2
SHA14c58f3242b5f7151bb790c2d89e709db8998fd87
SHA256d14fda3e54861a9a79bb7b3b5b445837b4b9517b000bd6d8753c73d3f1686f31
SHA5122481366fdc0bf3aae11d162b92c3a98539d5fbaeb917adfecb2de0827882ff6b5301e4ff301d6cae53babcbccb64211ec298b7370350933c10b9f82bdcd944fa
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
1.4MB
MD5795f4d5b37e321b7b555e9c92d835816
SHA103037d4caef930b5208aa29d29b1442ef2e934b9
SHA256f46999a95ca3f1c91d04599b327a3a0ab5ebf8b3845f0a039a57fa6f4b8007be
SHA512bb879274670f5a346570dc8860702036b4b43625d0d976dd40fc4bfb482d83d709f585c5d2db4e344eb95e7985d99d7f50f80a41160a54052e9fd66fa5d21d9f
-
memory/1864-15-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-10-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-16-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-5-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-6-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-8-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-23-0x0000000075360000-0x0000000075399000-memory.dmpFilesize
228KB
-
memory/1864-21-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-18-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-14-0x0000000074FE0000-0x0000000075019000-memory.dmpFilesize
228KB
-
memory/1864-20-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-22-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-13-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-17-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1864-19-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2660-26-0x00000000746D0000-0x0000000074E80000-memory.dmpFilesize
7.7MB
-
memory/4696-9-0x00000000750D0000-0x0000000075880000-memory.dmpFilesize
7.7MB
-
memory/4696-4-0x0000000007000000-0x000000000778A000-memory.dmpFilesize
7.5MB
-
memory/4696-3-0x0000000005490000-0x00000000054A0000-memory.dmpFilesize
64KB
-
memory/4696-2-0x0000000005A50000-0x0000000005FF4000-memory.dmpFilesize
5.6MB
-
memory/4696-1-0x0000000000170000-0x000000000090E000-memory.dmpFilesize
7.6MB
-
memory/4696-0-0x00000000750D0000-0x0000000075880000-memory.dmpFilesize
7.7MB