Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
19/11/2023, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe
Resource
win10v2004-20231023-en
General
-
Target
61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe
-
Size
387KB
-
MD5
5d22fa34c376cb47f21dcbb36c806446
-
SHA1
d4fc0c29163d9798ec5dc9481a5e93f3e5462683
-
SHA256
61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb
-
SHA512
5734965ae44fe7c82f8b8ff538ffd5a43fd5384a1de45571d9a20774ff0be1a5ee72f0cc784ae2278fa0ce623bdd6bc25ff77635f5c8ed36eedf0bcfc602f69f
-
SSDEEP
6144:5nALTWwzPIj4JwTW+wPBlOeLEe3whJVH:2TWwzPWCwLwPBNLRwH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2904 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3060 set thread context of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2488 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2488 taskkill.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 3060 wrote to memory of 1568 3060 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 28 PID 1568 wrote to memory of 2904 1568 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 31 PID 1568 wrote to memory of 2904 1568 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 31 PID 1568 wrote to memory of 2904 1568 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 31 PID 1568 wrote to memory of 2904 1568 61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe 31 PID 2904 wrote to memory of 2488 2904 cmd.exe 33 PID 2904 wrote to memory of 2488 2904 cmd.exe 33 PID 2904 wrote to memory of 2488 2904 cmd.exe 33 PID 2904 wrote to memory of 2488 2904 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe"C:\Users\Admin\AppData\Local\Temp\61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe"C:\Users\Admin\AppData\Local\Temp\61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe" & exit3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "61e2c0eb8b87b2cff74eeb9d9ad3c8a91e792b3618d9bd57f96232b70337b7fb.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
-