Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-12-2023 03:21
Static task
static1
Behavioral task
behavioral1
Sample
bf81ecf7e62d56f044f48b41e7b4be3c.exe
Resource
win7-20231215-en
General
-
Target
bf81ecf7e62d56f044f48b41e7b4be3c.exe
-
Size
132KB
-
MD5
bf81ecf7e62d56f044f48b41e7b4be3c
-
SHA1
fd42b423dcecc1373e3647f3d2f5386405a3cc09
-
SHA256
44cb7922931fb4c9c1ee124862e2cadd2a20b59425123991011fa6829cffb53c
-
SHA512
762517b275cded287447ae569d34b5490a691360e3613c5cdb917bd2c2996293db7bc380a369b37e9247f7bf88ea49579dee2aaf8ae7de30160fa5001023ff39
-
SSDEEP
1536:DfbmUgeUtHmOC6MLcuLpOk+fCdqLaVzRANwRziQa6Z3knH/P3JVgRYEIkht8gVD4:DfbmUkNmOJML3gl8ia4wvzCVkfVrMeP
Malware Config
Extracted
pony
http://67.215.225.205:8080/forum/viewtopic.php
http://209.59.219.70/forum/viewtopic.php
-
payload_url
http://birdofparadisepub.com/poQYPP.exe
http://15dimensionsofhealing.com/Qei73he.exe
http://petradumpe.com/UYoG.exe
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2512 2044 bf81ecf7e62d56f044f48b41e7b4be3c.exe 28 PID 2044 wrote to memory of 2512 2044 bf81ecf7e62d56f044f48b41e7b4be3c.exe 28 PID 2044 wrote to memory of 2512 2044 bf81ecf7e62d56f044f48b41e7b4be3c.exe 28 PID 2044 wrote to memory of 2512 2044 bf81ecf7e62d56f044f48b41e7b4be3c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe"C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe"C:\Users\Admin\AppData\Local\Temp\bf81ecf7e62d56f044f48b41e7b4be3c.exe"2⤵PID:2512
-