Analysis
-
max time kernel
183s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-01-2024 21:26
Static task
static1
Behavioral task
behavioral1
Sample
4736226d9a237c905fad4c5c89eb61d1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4736226d9a237c905fad4c5c89eb61d1.exe
Resource
win10v2004-20231215-en
General
-
Target
4736226d9a237c905fad4c5c89eb61d1.exe
-
Size
262KB
-
MD5
4736226d9a237c905fad4c5c89eb61d1
-
SHA1
b1e6731b1ced0ab43e986460c478d4c9d9497bef
-
SHA256
a92ad73c5b612720d3561622c6e11f18613d0ea39234870d6f6879e45d358f92
-
SHA512
17efec0e254e4a4a4fb7941bc5c935b6c3227f787e5a58cf86dda4cac538bfef459aee509fc8fe1d44c7890c79a96c8b0f027ccdd98980e8d3ad28818b200a86
-
SSDEEP
6144:Hv8Gp+df0afmVTRMdNdpn94sLrNXel9jb98+MATD:P8YkfXf4TRMj94svNuzjb9ZJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
feuda.exepid process 2736 feuda.exe -
Loads dropped DLL 1 IoCs
Processes:
4736226d9a237c905fad4c5c89eb61d1.exepid process 2892 4736226d9a237c905fad4c5c89eb61d1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
feuda.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\{6F76ACC8-CEF3-AD4E-FF1F-3295E8F41188} = "C:\\Users\\Admin\\AppData\\Roaming\\Ytka\\feuda.exe" feuda.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4736226d9a237c905fad4c5c89eb61d1.exedescription pid process target process PID 2892 set thread context of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2356 2812 WerFault.exe cmd.exe -
Processes:
4736226d9a237c905fad4c5c89eb61d1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Privacy 4736226d9a237c905fad4c5c89eb61d1.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 4736226d9a237c905fad4c5c89eb61d1.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
feuda.exepid process 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe 2736 feuda.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4736226d9a237c905fad4c5c89eb61d1.exedescription pid process Token: SeSecurityPrivilege 2892 4736226d9a237c905fad4c5c89eb61d1.exe Token: SeSecurityPrivilege 2892 4736226d9a237c905fad4c5c89eb61d1.exe Token: SeSecurityPrivilege 2892 4736226d9a237c905fad4c5c89eb61d1.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
4736226d9a237c905fad4c5c89eb61d1.exefeuda.exepid process 2892 4736226d9a237c905fad4c5c89eb61d1.exe 2736 feuda.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
4736226d9a237c905fad4c5c89eb61d1.exefeuda.execmd.exedescription pid process target process PID 2892 wrote to memory of 2736 2892 4736226d9a237c905fad4c5c89eb61d1.exe feuda.exe PID 2892 wrote to memory of 2736 2892 4736226d9a237c905fad4c5c89eb61d1.exe feuda.exe PID 2892 wrote to memory of 2736 2892 4736226d9a237c905fad4c5c89eb61d1.exe feuda.exe PID 2892 wrote to memory of 2736 2892 4736226d9a237c905fad4c5c89eb61d1.exe feuda.exe PID 2736 wrote to memory of 1120 2736 feuda.exe taskhost.exe PID 2736 wrote to memory of 1120 2736 feuda.exe taskhost.exe PID 2736 wrote to memory of 1120 2736 feuda.exe taskhost.exe PID 2736 wrote to memory of 1120 2736 feuda.exe taskhost.exe PID 2736 wrote to memory of 1120 2736 feuda.exe taskhost.exe PID 2736 wrote to memory of 1188 2736 feuda.exe Dwm.exe PID 2736 wrote to memory of 1188 2736 feuda.exe Dwm.exe PID 2736 wrote to memory of 1188 2736 feuda.exe Dwm.exe PID 2736 wrote to memory of 1188 2736 feuda.exe Dwm.exe PID 2736 wrote to memory of 1188 2736 feuda.exe Dwm.exe PID 2736 wrote to memory of 1260 2736 feuda.exe Explorer.EXE PID 2736 wrote to memory of 1260 2736 feuda.exe Explorer.EXE PID 2736 wrote to memory of 1260 2736 feuda.exe Explorer.EXE PID 2736 wrote to memory of 1260 2736 feuda.exe Explorer.EXE PID 2736 wrote to memory of 1260 2736 feuda.exe Explorer.EXE PID 2736 wrote to memory of 2892 2736 feuda.exe 4736226d9a237c905fad4c5c89eb61d1.exe PID 2736 wrote to memory of 2892 2736 feuda.exe 4736226d9a237c905fad4c5c89eb61d1.exe PID 2736 wrote to memory of 2892 2736 feuda.exe 4736226d9a237c905fad4c5c89eb61d1.exe PID 2736 wrote to memory of 2892 2736 feuda.exe 4736226d9a237c905fad4c5c89eb61d1.exe PID 2736 wrote to memory of 2892 2736 feuda.exe 4736226d9a237c905fad4c5c89eb61d1.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2892 wrote to memory of 2812 2892 4736226d9a237c905fad4c5c89eb61d1.exe cmd.exe PID 2812 wrote to memory of 2356 2812 cmd.exe WerFault.exe PID 2812 wrote to memory of 2356 2812 cmd.exe WerFault.exe PID 2812 wrote to memory of 2356 2812 cmd.exe WerFault.exe PID 2812 wrote to memory of 2356 2812 cmd.exe WerFault.exe PID 2736 wrote to memory of 1620 2736 feuda.exe conhost.exe PID 2736 wrote to memory of 1620 2736 feuda.exe conhost.exe PID 2736 wrote to memory of 1620 2736 feuda.exe conhost.exe PID 2736 wrote to memory of 1620 2736 feuda.exe conhost.exe PID 2736 wrote to memory of 1620 2736 feuda.exe conhost.exe PID 2736 wrote to memory of 2356 2736 feuda.exe WerFault.exe PID 2736 wrote to memory of 2356 2736 feuda.exe WerFault.exe PID 2736 wrote to memory of 2356 2736 feuda.exe WerFault.exe PID 2736 wrote to memory of 2356 2736 feuda.exe WerFault.exe PID 2736 wrote to memory of 2356 2736 feuda.exe WerFault.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\4736226d9a237c905fad4c5c89eb61d1.exe"C:\Users\Admin\AppData\Local\Temp\4736226d9a237c905fad4c5c89eb61d1.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Roaming\Ytka\feuda.exe"C:\Users\Admin\AppData\Roaming\Ytka\feuda.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd1f810ad.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1164⤵
- Program crash
PID:2356
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-400656756-1558211121-64129222-12080864211975896732-1133015696444122183-1892289517"1⤵PID:1620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
366B
MD5de03d8538369f7e4c10fc90c674fc726
SHA196dd422474473e29db15acbc4a19e124e4452b05
SHA25654007e5f4c5c189a81e6dfc2cb57b6c61a7827b69ab3531a4801d204a7369789
SHA512c1537baf09ed9b55652c71d2790e40ba3aaa17698e3b2a00c77af9d355eff72fc0e7adda99fc57a81e9a064fc7b49f1ce298a0584686eddc4694ebea57b3d0a6
-
Filesize
262KB
MD5741de4a43c8763b63ff3b529d2caab3d
SHA11caf06dc61a09fbbca189606c7fd80de513bafe3
SHA2563d1882909439a14f0f08cde308a13969121f73867293c17346d55754ffcc1b2f
SHA51290c29b090508e7d4063ef0f7acf6337d162ec024dd96f02cde976de8a55b974542c9bd962dd00810dfbc3a2d8d2484ef8fcdf13c9c18d6b0f875dfc143e09295