Analysis
-
max time kernel
65s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 07:56
Static task
static1
Behavioral task
behavioral1
Sample
2e32af0a253629770be3523b0606c97c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2e32af0a253629770be3523b0606c97c.exe
Resource
win10v2004-20231215-en
General
-
Target
2e32af0a253629770be3523b0606c97c.exe
-
Size
2.6MB
-
MD5
2e32af0a253629770be3523b0606c97c
-
SHA1
ac60258698f4cd926b3afd69b5275972eae7aeb9
-
SHA256
96a30539fee5c0fbd077700e0c8605e12ac497020d9d9d8e4f2886f5abf7c31b
-
SHA512
995c8bbccc4fe1736ebb59efcb5b50feeca5e6454cad912ccd3a76103a5081c1d3d3e72daf47bdbbfae31ca71854983483c1ee324aaec3d794bc7c7ee9971177
-
SSDEEP
49152:GuuEoyPJJFc4sIe7yAsxjTNwquM4e04xvbjATC2z+v6:GcPnFc4szuRHYN4J2zN
Malware Config
Extracted
bitrat
1.38
dns16-microsoft-health.com:80
-
communication_password
1fb84c2caca11d084aafca61f7284a70
-
install_dir
Intel
-
install_file
idrvr32.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\idrvr32 = "C:\\Users\\Admin\\AppData\\Local\\Intel\\idrvr32.exe" 2e32af0a253629770be3523b0606c97c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 880 set thread context of 2740 880 2e32af0a253629770be3523b0606c97c.exe 17 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 880 2e32af0a253629770be3523b0606c97c.exe -
Suspicious behavior: RenamesItself 13 IoCs
pid Process 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2740 2e32af0a253629770be3523b0606c97c.exe Token: SeShutdownPrivilege 2740 2e32af0a253629770be3523b0606c97c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 880 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe 2740 2e32af0a253629770be3523b0606c97c.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 880 wrote to memory of 2740 880 2e32af0a253629770be3523b0606c97c.exe 17 PID 880 wrote to memory of 2740 880 2e32af0a253629770be3523b0606c97c.exe 17 PID 880 wrote to memory of 2740 880 2e32af0a253629770be3523b0606c97c.exe 17 PID 880 wrote to memory of 2740 880 2e32af0a253629770be3523b0606c97c.exe 17 PID 880 wrote to memory of 2740 880 2e32af0a253629770be3523b0606c97c.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e32af0a253629770be3523b0606c97c.exe"C:\Users\Admin\AppData\Local\Temp\2e32af0a253629770be3523b0606c97c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2e32af0a253629770be3523b0606c97c.exe"C:\Users\Admin\AppData\Local\Temp\2e32af0a253629770be3523b0606c97c.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2740
-