Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
16-01-2024 02:45
Static task
static1
Behavioral task
behavioral1
Sample
5ec2c541a8a9480a6171083f7426d699.exe
Resource
win7-20231215-en
General
-
Target
5ec2c541a8a9480a6171083f7426d699.exe
-
Size
2.2MB
-
MD5
5ec2c541a8a9480a6171083f7426d699
-
SHA1
92d3c8040709432ffeb309f0097c463c14d05a60
-
SHA256
75c904276bfa29c610f17379679bc346d3cde985094c0fc3f088cbfcf9c05528
-
SHA512
a6156391d84c7bd7e3788875c5924832ddf4ac35c14f667a7fa1b78192e7403981127992a5615a3c1183f40e0820bff30418c9a62e522d39661a0d8353c6a945
-
SSDEEP
49152:KqWXbXAVzJPvk9mWIyRuzF4+2VI02OP6cf8pww9:KqKTAV9PvCmoa02OUua
Malware Config
Extracted
bitrat
1.38
cs50.publicvm.com:5162
-
communication_password
827ccb0eea8a706c4c34a16891f84e7b
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5ec2c541a8a9480a6171083f7426d699.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 5ec2c541a8a9480a6171083f7426d699.exe -
Processes:
resource yara_rule behavioral2/memory/696-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-18-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-20-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-26-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-28-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-32-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-35-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-36-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-37-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-39-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-40-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-42-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/696-43-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
RegSvcs.exepid process 696 RegSvcs.exe 696 RegSvcs.exe 696 RegSvcs.exe 696 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5ec2c541a8a9480a6171083f7426d699.exedescription pid process target process PID 1612 set thread context of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5ec2c541a8a9480a6171083f7426d699.exepid process 1612 5ec2c541a8a9480a6171083f7426d699.exe 1612 5ec2c541a8a9480a6171083f7426d699.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5ec2c541a8a9480a6171083f7426d699.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1612 5ec2c541a8a9480a6171083f7426d699.exe Token: SeShutdownPrivilege 696 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegSvcs.exepid process 696 RegSvcs.exe 696 RegSvcs.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
5ec2c541a8a9480a6171083f7426d699.exedescription pid process target process PID 1612 wrote to memory of 2788 1612 5ec2c541a8a9480a6171083f7426d699.exe schtasks.exe PID 1612 wrote to memory of 2788 1612 5ec2c541a8a9480a6171083f7426d699.exe schtasks.exe PID 1612 wrote to memory of 2788 1612 5ec2c541a8a9480a6171083f7426d699.exe schtasks.exe PID 1612 wrote to memory of 3800 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 3800 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 3800 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe PID 1612 wrote to memory of 696 1612 5ec2c541a8a9480a6171083f7426d699.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ec2c541a8a9480a6171083f7426d699.exe"C:\Users\Admin\AppData\Local\Temp\5ec2c541a8a9480a6171083f7426d699.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CHISoIz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA90C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA90C.tmpFilesize
1KB
MD58cc6870842f22e6e2538be04df9c07ff
SHA14c5db4506512203ca3fe406cbe53b4b8f55973aa
SHA256c3f7451a1b5a1c2a417f866dfc49a77c8083bbd398f769a40bd90cc79c6cff1e
SHA51210dde0d5983b735ec670eaea4a8cee42421e2c13ee4b86f7e0f3ef5048ceede47db28151580f58337c6c2792d5dc00a145c29b601c7a1969413f3f504069f751
-
memory/696-33-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-16-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-44-0x00000000750B0000-0x00000000750E9000-memory.dmpFilesize
228KB
-
memory/696-24-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-43-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-26-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-42-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-25-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-41-0x00000000750B0000-0x00000000750E9000-memory.dmpFilesize
228KB
-
memory/696-40-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-39-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-38-0x00000000750B0000-0x00000000750E9000-memory.dmpFilesize
228KB
-
memory/696-15-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-32-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-18-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-37-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-20-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-19-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-22-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-23-0x0000000074D30000-0x0000000074D69000-memory.dmpFilesize
228KB
-
memory/696-36-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-35-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-34-0x00000000750B0000-0x00000000750E9000-memory.dmpFilesize
228KB
-
memory/696-28-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-27-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-29-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-30-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/696-31-0x00000000750B0000-0x00000000750E9000-memory.dmpFilesize
228KB
-
memory/1612-1-0x0000000000100000-0x000000000033A000-memory.dmpFilesize
2.2MB
-
memory/1612-0-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/1612-6-0x0000000004FC0000-0x0000000004FC8000-memory.dmpFilesize
32KB
-
memory/1612-8-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/1612-4-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/1612-21-0x0000000074E20000-0x00000000755D0000-memory.dmpFilesize
7.7MB
-
memory/1612-2-0x00000000053E0000-0x0000000005984000-memory.dmpFilesize
5.6MB
-
memory/1612-11-0x0000000008300000-0x00000000084B4000-memory.dmpFilesize
1.7MB
-
memory/1612-10-0x0000000008520000-0x000000000872C000-memory.dmpFilesize
2.0MB
-
memory/1612-9-0x0000000004FF0000-0x0000000005000000-memory.dmpFilesize
64KB
-
memory/1612-7-0x0000000007800000-0x000000000789C000-memory.dmpFilesize
624KB
-
memory/1612-5-0x0000000004DE0000-0x0000000004DEA000-memory.dmpFilesize
40KB
-
memory/1612-3-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB