Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 20:08
Static task
static1
Behavioral task
behavioral1
Sample
8e3bce07666fd0f9f811c457ed7af20b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8e3bce07666fd0f9f811c457ed7af20b.exe
Resource
win10v2004-20231215-en
General
-
Target
8e3bce07666fd0f9f811c457ed7af20b.exe
-
Size
2.2MB
-
MD5
8e3bce07666fd0f9f811c457ed7af20b
-
SHA1
ec76d846f02926cfe67166554e9c060222527c08
-
SHA256
1e7241871b2af1f8488a0812f273b73f86d2c9f2ce7b0e6bf3b1fc6a46bd27d3
-
SHA512
52da7228497d6974a8597d8fed5e0a0b1a87b0b487891d4147bcff1b8cab0ff383e017f7a0c80c6b1c1df3db18397f620623118346c1e871dd513202ef4e365e
-
SSDEEP
49152:fd4cfizng5F5A48pMXEztH1TX3LlrmovkoaSv4bQkEL5Qqkz:Ff8g75A4We6/TXbQovrWbQkELixz
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9070
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
windownslogoiniciodir
-
install_file
windownslogoinicio.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2328-11-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-12-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-17-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-18-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-26-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-28-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-31-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-32-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/2328-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\windownslogoinicio = "C:\\Users\\Admin\\AppData\\Local\\windownslogoiniciodir\\windownslogoinicio.exe" 8e3bce07666fd0f9f811c457ed7af20b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exepid process 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exedescription pid process target process PID 1968 set thread context of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe -
Suspicious behavior: RenamesItself 22 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exepid process 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exedescription pid process Token: SeDebugPrivilege 2328 8e3bce07666fd0f9f811c457ed7af20b.exe Token: SeShutdownPrivilege 2328 8e3bce07666fd0f9f811c457ed7af20b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exepid process 2328 8e3bce07666fd0f9f811c457ed7af20b.exe 2328 8e3bce07666fd0f9f811c457ed7af20b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8e3bce07666fd0f9f811c457ed7af20b.exedescription pid process target process PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe PID 1968 wrote to memory of 2328 1968 8e3bce07666fd0f9f811c457ed7af20b.exe 8e3bce07666fd0f9f811c457ed7af20b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3bce07666fd0f9f811c457ed7af20b.exe"C:\Users\Admin\AppData\Local\Temp\8e3bce07666fd0f9f811c457ed7af20b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\8e3bce07666fd0f9f811c457ed7af20b.exe"C:\Users\Admin\AppData\Local\Temp\8e3bce07666fd0f9f811c457ed7af20b.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1968-1-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/1968-0-0x0000000000B10000-0x0000000000D48000-memory.dmpFilesize
2.2MB
-
memory/1968-2-0x0000000004E90000-0x0000000004ED0000-memory.dmpFilesize
256KB
-
memory/1968-3-0x00000000003F0000-0x000000000040A000-memory.dmpFilesize
104KB
-
memory/1968-4-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/1968-5-0x0000000004E90000-0x0000000004ED0000-memory.dmpFilesize
256KB
-
memory/1968-6-0x00000000084E0000-0x0000000008698000-memory.dmpFilesize
1.7MB
-
memory/1968-7-0x0000000000630000-0x0000000000636000-memory.dmpFilesize
24KB
-
memory/1968-8-0x00000000086A0000-0x0000000008826000-memory.dmpFilesize
1.5MB
-
memory/1968-20-0x00000000749D0000-0x00000000750BE000-memory.dmpFilesize
6.9MB
-
memory/2328-16-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-24-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2328-15-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-11-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-17-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-18-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-9-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-19-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-21-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-22-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-12-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-25-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-26-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-28-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-29-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-30-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-31-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-32-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-33-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2328-34-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB