Analysis
-
max time kernel
145s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 23:37
Static task
static1
Behavioral task
behavioral1
Sample
43b3cb0d8ead9a35e8bcda2048c3312f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
43b3cb0d8ead9a35e8bcda2048c3312f.exe
Resource
win10v2004-20231222-en
General
-
Target
43b3cb0d8ead9a35e8bcda2048c3312f.exe
-
Size
201KB
-
MD5
43b3cb0d8ead9a35e8bcda2048c3312f
-
SHA1
ba6b0d323f7a84367318bee772fe5cef0aff8c4c
-
SHA256
212289b78e550d8af514e2efe785521d8c6e439d46789993711bdfe5b0bb2e6e
-
SHA512
8d976541f6795db207b4bf56fe6298126017322d6498fb7fd7f1b34e91068784d81e43efc7df131ece0b03476479afb7c91338396002edec4452a39b00e689a2
-
SSDEEP
6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFb:HqEjk7l7Fb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
security.exesecurity.exepid process 2596 security.exe 2744 security.exe -
Loads dropped DLL 6 IoCs
Processes:
43b3cb0d8ead9a35e8bcda2048c3312f.exesecurity.exepid process 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe 2596 security.exe -
Processes:
resource yara_rule behavioral1/memory/1216-393-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1216-398-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1216-902-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2744-905-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
43b3cb0d8ead9a35e8bcda2048c3312f.exesecurity.exedescription pid process target process PID 2040 set thread context of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2596 set thread context of 2744 2596 security.exe security.exe PID 2596 set thread context of 1796 2596 security.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
security.exedescription pid process Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe Token: SeDebugPrivilege 2744 security.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
43b3cb0d8ead9a35e8bcda2048c3312f.exe43b3cb0d8ead9a35e8bcda2048c3312f.exesecurity.exesecurity.exepid process 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe 2596 security.exe 2744 security.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
43b3cb0d8ead9a35e8bcda2048c3312f.exe43b3cb0d8ead9a35e8bcda2048c3312f.execmd.exesecurity.exedescription pid process target process PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 2040 wrote to memory of 1216 2040 43b3cb0d8ead9a35e8bcda2048c3312f.exe 43b3cb0d8ead9a35e8bcda2048c3312f.exe PID 1216 wrote to memory of 2676 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe cmd.exe PID 1216 wrote to memory of 2676 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe cmd.exe PID 1216 wrote to memory of 2676 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe cmd.exe PID 1216 wrote to memory of 2676 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe cmd.exe PID 2676 wrote to memory of 2612 2676 cmd.exe reg.exe PID 2676 wrote to memory of 2612 2676 cmd.exe reg.exe PID 2676 wrote to memory of 2612 2676 cmd.exe reg.exe PID 2676 wrote to memory of 2612 2676 cmd.exe reg.exe PID 1216 wrote to memory of 2596 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe security.exe PID 1216 wrote to memory of 2596 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe security.exe PID 1216 wrote to memory of 2596 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe security.exe PID 1216 wrote to memory of 2596 1216 43b3cb0d8ead9a35e8bcda2048c3312f.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 2744 2596 security.exe security.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe PID 2596 wrote to memory of 1796 2596 security.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe"C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe"C:\Users\Admin\AppData\Local\Temp\43b3cb0d8ead9a35e8bcda2048c3312f.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EJXGG.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1216-393-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1216-902-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1216-398-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2040-10-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/2040-2-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2040-304-0x00000000005E0000-0x00000000005E1000-memory.dmpFilesize
4KB
-
memory/2040-122-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2040-123-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2040-20-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2040-4-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2040-303-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/2040-16-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2596-591-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2596-594-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2596-727-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/2596-589-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2744-905-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB