adwind | ce236d04aae0118265f73e1775a0ce05aa6357e0922905b2d08540f100c37ee5

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/12/2023, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sorrilus.exe
Size 10.3MB
Sample231202-e49z8ahg91
SHA256 314278fc36d4bf2c2051c64b5dd274c6254e51c8db45bb5174750839f63bab53
MD5 e4732ee9e8c0aa3276a51141b8b9b2d9
SHA1 3f5a763f1571551505fe89bdb2287b001a8ff009
SHA512 207c194c0d8554d84bbbecda4f06c746bdf3a77b3db0cab1717c029244d5f86a1357e9c3861f53e5e19f6b5d00d77c18cd923ef6d93b94eeb0128300872ae0a4
SSDEEP 196608:O2SvZ+chSsAhnS9+vFKWdfnP4L20N37Y2BqJMUrE6ed1g2ceCLTG1L09+Y7Ru:OlvZxBAA+vF55AL20UaeVy1pceCXEL09
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 2 IoCs

resource	yara_rule
sample	family_adwind4
sample	family_adwind4

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2192	1656	sorrilus.exe	28
PID 1656 wrote to memory of 2192	1656	sorrilus.exe	28
PID 1656 wrote to memory of 2192	1656	sorrilus.exe	28
PID 1656 wrote to memory of 3032	1656	sorrilus.exe	29
PID 1656 wrote to memory of 3032	1656	sorrilus.exe	29
PID 1656 wrote to memory of 3032	1656	sorrilus.exe	29

C:\Users\Admin\AppData\Local\Temp\sorrilus.exe
"C:\Users\Admin\AppData\Local\Temp\sorrilus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Sorillas-removedbackdoor.jar"
  2⤵
  PID:2192
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\sorrilus.jar"
  2⤵
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sorillas-removedbackdoor.jar

Path C:\Users\Admin\AppData\Local\Temp\Sorillas-removedbackdoor.jar
Size 10.0MB
SHA256 a3d0b59724e76cc3b4e4e132e0d344b679ae412b5e9c4faeb91bc33f45cbc5f6
MD5 e5b50a7c1da0dc7799b22699881a7bbb
SHA1 74a2dd531a7e45a09557e9b3459bf07e2f028aa3
SHA512 ae1c7d3b6e2470dfabb8883ea7fb3f6fe88e06308482e1c2f89bef0a353a8f73daea7e740b81be49d3915dc237c096598567e69555899d0ebc51847fe2fd53ac
SSDEEP 196608:qlloD+JydJIFFM0rT/mpDni/Mcd8qAbPeGmeIWvhAn9QrmU:qHop0FM02JiEQ/kGdeIWJC9Qrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sorrilus.jar

Path C:\Users\Admin\AppData\Local\Temp\sorrilus.jar
Size 639KB
SHA256 0bdc882b0cc311d814ac582592562f73a225701a474a023ceb8fa92a773fe5a2
MD5 09f5742b867972d346605e5f3da25e7a
SHA1 28ec50f0d3b1c357c5ffced62daa5d5552eb9cd1
SHA512 82997178ce8026eceae0833e04f1c61f863409111e351cbe6b65237bc8efb67bd8ff6bfdc1452597f540bd25a7a8b1df629a78b7fa43950b9c59d2c986f8a5c4
SSDEEP 12288:dbZ6QA/gSgPmP4jWEuVHgY/NRr+ZseN2BNg0VGR2/3Su42Z4S3XDI/:dbQQM8PO4y3HgY3uN2BSybSu1ZD3XDI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1656-0-0x0000000001090000-0x0000000001AE8000-memory.dmp

Download

memory/1656-1-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Download

memory/1656-2-0x000000001BED0000-0x000000001BF50000-memory.dmp

Download

memory/1656-8-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Download

memory/2192-17-0x0000000002640000-0x0000000005640000-memory.dmp

Download

memory/2192-29-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/3032-12-0x0000000002520000-0x0000000005520000-memory.dmp

Download

memory/3032-28-0x0000000000130000-0x0000000000131000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads