Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02-12-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
WWSBot.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
WWSBot.exe
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
WWSBot.exe
Resource
win10v2004-20231130-en
General
-
Target
WWSBot.exe
-
Size
8.6MB
-
MD5
d1b34597bc267179917191267189a4a6
-
SHA1
fd37c0f66c80e43fb503451f32527496dfb6e981
-
SHA256
432a7171271b0d0135e2acff0e050b5f1a4b6a54a3f04d6e58d598f687c9c128
-
SHA512
d848e7dae60ca4a13f4ed4a7cb0a2ae27e5b6865c4f1c617c0b528299e3489d84b49253528161b9e81db7ea51ade1eb6a993ac277ebadd2c4a860cebff2c8803
-
SSDEEP
24576:tN+qbmS6e/1ijwnQFpP1CJUmWw5/Ky9YawDZoaZC0gvbm49kLDA5gHdf6sxJwESo:WqbmSL/0wnQX1C3gk+lKbyf/z1
Malware Config
Extracted
aurora
94.142.138.29:8081
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
WWSBot.exedescription pid process target process PID 2196 set thread context of 1632 2196 WWSBot.exe WWSBot.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2548 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 2548 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe 2548 taskmgr.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
WWSBot.exedescription pid process target process PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe PID 2196 wrote to memory of 1632 2196 WWSBot.exe WWSBot.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"C:\Users\Admin\AppData\Local\Temp\WWSBot.exe"2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1632-21-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-8-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-0-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-6-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-22-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-10-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-12-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-23-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-16-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-18-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-19-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-20-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-4-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-2-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-14-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmpFilesize
4KB
-
memory/1632-40-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-38-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-27-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-29-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-36-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/1632-33-0x0000000000400000-0x000000000075C000-memory.dmpFilesize
3.4MB
-
memory/2548-30-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2548-31-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2548-26-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2548-25-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB