Overview
overview
10Static
static
10001e9becdd...93.exe
windows10-2004-x64
71a1cf2a2f6...31.exe
windows10-2004-x64
72eac3720bc...61.exe
windows10-2004-x64
1320e3af17b...4c.exe
windows10-2004-x64
333bcab7033...70.exe
windows10-2004-x64
647a52afd63...2e.exe
windows10-2004-x64
104b24d27301...69.exe
windows10-2004-x64
74c481d251f...5a.exe
windows10-2004-x64
14c9ab76300...dd.exe
windows10-2004-x64
650a04b093c...95.dll
windows10-2004-x64
65266183553...2f.dll
windows10-2004-x64
8547798defb...6e.exe
windows10-2004-x64
105fb2242c04...96.exe
windows10-2004-x64
163a0bf6385...12.exe
windows10-2004-x64
106a08b51e02...68.exe
windows10-2004-x64
5803d827a2c...53.exe
windows10-2004-x64
785523c6377...c3.exe
windows10-2004-x64
38ab3db7349...03.exe
windows10-2004-x64
99b87457fe8...f0.exe
windows10-2004-x64
8a3c7b0df18...cc.exe
windows10-2004-x64
1ab4fa067af...38.exe
windows10-2004-x64
10b1c5c3ca41...7d.exe
windows10-2004-x64
3ca561f9403...c5.exe
windows10-2004-x64
7d278eb3d6c...8f.exe
windows10-2004-x64
6d3e04348f4...91.exe
windows10-2004-x64
10d7e876a714...c9.exe
windows10-2004-x64
7dd8bf2763c...38.exe
windows10-2004-x64
dd9ca1355f...9a.exe
windows10-2004-x64
7dd9d07d1f5...27.exe
windows10-2004-x64
10ef3c260fed...49.exe
windows10-2004-x64
10f40df86d68...df.exe
windows10-2004-x64
10fb861230c0...01.exe
windows10-2004-x64
3Analysis
-
max time kernel
151s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2023 21:16
Behavioral task
behavioral1
Sample
001e9becdd7d9887c6fbe487073ad3dc068124a5300f4128d9ed32db4f63f793.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
2eac3720bcfb4550e3093f053880b373068360bc8583f2aee059905bcad29c61.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
320e3af17bb8787283fe0c4af9d3a778c191d8374f19c0bc6b6ee2f22363094c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
33bcab70334406fb3331b4b3fffbf8c51df52d93efb5d673d865b7a7496b1570.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
4b24d273019579ba3c1e0ad261954c0941d114aab802fa2d1fcb14dab9f3e869.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
4c481d251f29295af1af599374ea93f9fc24b6139fbb02ec115bec9f4e7bc25a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral10
Sample
50a04b093c8f05481eb672ebec0537f61e233071798d1f3b939e17e333b51795.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
5266183553addd392a0968ea9e835c00e55a27468829ab65832cda37508c8e2f.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
547798defb6d577ec9f13b00fb1be293f903aaa974ddc049be16d6437aeec86e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
5fb2242c04ce18830b84de73c4f0fc4e9c8a5e6877a14f414fcbfaa5a3948896.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
63a0bf6385356dd0297449bdca2a2f171846315505800e81a4c0285f09c87312.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
803d827a2cd764008783e691ce132ef853dbfa77017e5d2eeae47ceb3ca50f53.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
85523c6377c27e22068a2ef347997a295981b91e103b3cf3387ed80aa0b010c3.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral18
Sample
8ab3db7349f38d6463a3c6a7155ab297f18d92262a098064ea2472cecc7e3103.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
9b87457fe85670e2c059cedaa560a8a31027e96fe18b2b6a7fe610f38423b2f0.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral20
Sample
a3c7b0df189bdd47c7e113ff3b664f26b0bcd6f4f878186e882ea199e15c28cc.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral22
Sample
b1c5c3ca41c322b47a5feb62ebb0e5daa3c1c682aa1dedb98fd3b7dff3eca57d.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
ca561f9403ab4be76ca66646df1a3da826fa2cc1972dd005ad23861abb317cc5.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral24
Sample
d278eb3d6cc29c6de4b086aaa6214412d62fe2bb850c0ead63a403c3a24b2c8f.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
dd8bf2763ce09cbeb21cdbf802b9f7475c7998e459714150fae07ffcd027bb38.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral28
Sample
dd9ca1355ff3ddd883f9d2d0e6df9b7a8ebff650003a616c533b30554cee2a9a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
dd9d07d1f5bb4facb1b4e412ce9e52a5ca9a689f2f78c34bacf63af19f7ce127.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
ef3c260fed0a71f0e679261aeb242133899f9ff03d68b5f95711a66ef919e549.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
f40df86d68d075c73e1be8ed5b3201f0e55a9eccf662258a219acee35df398df.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral32
Sample
fb861230c088dd68f1a6c782e9ad0b44a1831ccc29c0516635cc4b3de2a91a01.exe
Resource
win10v2004-20231023-en
General
-
Target
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe
-
Size
303KB
-
MD5
70e94f2ed65211ee0b4ee143fa6d300b
-
SHA1
ff8bb6f7220ed3f67d23b710bffddfa3e2e46d83
-
SHA256
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9
-
SHA512
fbd1fde8675d966fb47f86f59f6bd8c3dc2d5f97d12d56d1cd978cd918058b128496c5b1382fda9876958f91e32088d97646ebca2926833c738e39f62d6a8332
-
SSDEEP
6144:7CSOgPDKvKum02kU1zZcYfNE+JoEPNaUW/AFSjNCi:+SxPDfuuVH1bPNaUWFj3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a2ee8a90.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*2ee8a90 = "C:\\Users\\Admin\\AppData\\Roaming\\a2ee8a90.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2ee8a9 = "C:\\a2ee8a90\\a2ee8a90.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*2ee8a9 = "C:\\a2ee8a90\\a2ee8a90.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a2ee8a90 = "C:\\Users\\Admin\\AppData\\Roaming\\a2ee8a90.exe" explorer.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 ip-addr.es 29 ip-addr.es 153 ip-addr.es -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exeexplorer.exepid process 3196 d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe 996 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exeexplorer.exedescription pid process target process PID 3196 wrote to memory of 996 3196 d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe explorer.exe PID 3196 wrote to memory of 996 3196 d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe explorer.exe PID 3196 wrote to memory of 996 3196 d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe explorer.exe PID 996 wrote to memory of 2176 996 explorer.exe svchost.exe PID 996 wrote to memory of 2176 996 explorer.exe svchost.exe PID 996 wrote to memory of 2176 996 explorer.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe"C:\Users\Admin\AppData\Local\Temp\d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-13-0x00000000012B0000-0x00000000012D5000-memory.dmpFilesize
148KB
-
memory/996-25-0x00000000012B0000-0x00000000012D5000-memory.dmpFilesize
148KB
-
memory/996-16-0x00000000012B0000-0x00000000012D5000-memory.dmpFilesize
148KB
-
memory/2176-26-0x0000000000840000-0x0000000000865000-memory.dmpFilesize
148KB
-
memory/2176-21-0x0000000000840000-0x0000000000865000-memory.dmpFilesize
148KB
-
memory/2176-20-0x0000000000840000-0x0000000000865000-memory.dmpFilesize
148KB
-
memory/3196-8-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/3196-7-0x00000000025B0000-0x0000000002614000-memory.dmpFilesize
400KB
-
memory/3196-0-0x00000000025B0000-0x0000000002614000-memory.dmpFilesize
400KB
-
memory/3196-9-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/3196-10-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3196-6-0x00000000025B0000-0x0000000002614000-memory.dmpFilesize
400KB
-
memory/3196-15-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3196-5-0x00000000025B0000-0x0000000002614000-memory.dmpFilesize
400KB
-
memory/3196-4-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/3196-3-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/3196-2-0x00000000025B0000-0x0000000002614000-memory.dmpFilesize
400KB
-
memory/3196-1-0x00000000025B0000-0x0000000002614000-memory.dmpFilesize
400KB