Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 12:34
Static task
static1
Behavioral task
behavioral1
Sample
deee27d22505bd8e59a238ff922df2ff.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
deee27d22505bd8e59a238ff922df2ff.exe
Resource
win10v2004-20231215-en
General
-
Target
deee27d22505bd8e59a238ff922df2ff.exe
-
Size
2.0MB
-
MD5
deee27d22505bd8e59a238ff922df2ff
-
SHA1
b7a84ce3b528852afd40f2bd980c7eb2651c581d
-
SHA256
8ff6efab7b7b9a8e05edf2a88e6ba3e6d5c0130794c1c6fddcde7ccfb024e6eb
-
SHA512
ec4d7d38c4b6b4a62ea9361a5b4d7c315ab8b523b35bc67774f554897a3ba7fd295d2827de8dc1c03da72b400618d48af787ecbcc81d851227e58145ae05026e
-
SSDEEP
49152:JXyPwqt9nptBilanQvg4zLW1ZzKvKidr1pX0osvQ4H4444C:EP/pt7QhzMOhn0oiQ4H4444C
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9085
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
Googlechromeinite
-
install_file
Googlechromeinit.exe
-
tor_process
tor
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/1900-7-0x0000000004820000-0x0000000004832000-memory.dmp CustAttr -
Processes:
resource yara_rule behavioral2/memory/2120-12-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-14-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-23-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-26-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-31-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/2120-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googlechromeinit = "C:\\Users\\Admin\\AppData\\Local\\Googlechromeinite\\Googlechromeinit.exe" deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exepid process 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription pid process target process PID 1900 set thread context of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious behavior: RenamesItself 14 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exepid process 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription pid process Token: SeShutdownPrivilege 2120 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exepid process 2120 deee27d22505bd8e59a238ff922df2ff.exe 2120 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription pid process target process PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1900 wrote to memory of 2120 1900 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1900-0-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/1900-1-0x0000000000220000-0x0000000000422000-memory.dmpFilesize
2.0MB
-
memory/1900-2-0x0000000005410000-0x00000000059B4000-memory.dmpFilesize
5.6MB
-
memory/1900-4-0x0000000004F00000-0x0000000004F9C000-memory.dmpFilesize
624KB
-
memory/1900-3-0x0000000004E60000-0x0000000004EF2000-memory.dmpFilesize
584KB
-
memory/1900-5-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/1900-6-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/1900-7-0x0000000004820000-0x0000000004832000-memory.dmpFilesize
72KB
-
memory/1900-8-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/1900-9-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/1900-10-0x0000000006A50000-0x0000000006C14000-memory.dmpFilesize
1.8MB
-
memory/1900-11-0x0000000006EF0000-0x000000000706C000-memory.dmpFilesize
1.5MB
-
memory/1900-18-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/2120-15-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-28-0x0000000074870000-0x00000000748A9000-memory.dmpFilesize
228KB
-
memory/2120-16-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-13-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-12-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-19-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-20-0x0000000074BB0000-0x0000000074BE9000-memory.dmpFilesize
228KB
-
memory/2120-21-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-23-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-25-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-27-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-14-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-26-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-24-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-22-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-29-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-30-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-32-0x0000000074870000-0x00000000748A9000-memory.dmpFilesize
228KB
-
memory/2120-31-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-33-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-34-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/2120-35-0x0000000074870000-0x00000000748A9000-memory.dmpFilesize
228KB