Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 13:38
Static task
static1
Behavioral task
behavioral1
Sample
7781c1145869cdf87cf61d671247e80e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7781c1145869cdf87cf61d671247e80e.exe
Resource
win10v2004-20231215-en
General
-
Target
7781c1145869cdf87cf61d671247e80e.exe
-
Size
379KB
-
MD5
7781c1145869cdf87cf61d671247e80e
-
SHA1
e2f76f546d3e4ff3e748fb6d4b1b3d2890c3b1da
-
SHA256
8ade36ca05b733841f178b46dabeefcd3cadb0d91ce83e0e313b68376c75189c
-
SHA512
6d1767dc3ef0751f7a1d4c4b43d621a48a06124780e57393e5a5a8039d66a90468e8ba09a44210d02e63ab06c0bb367755f43220c9c265f2a3c5bf1ad9cdf776
-
SSDEEP
6144:Lu2urzh9xu/XkauJza8em0Xs0anV3Ve1h3yU1OIGtNAkoIaNOBG29J8YLj4UdC/P:Lutrzh9xOXkFa8em0X0V3U1hx1OIGtNQ
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.exe 7781c1145869cdf87cf61d671247e80e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\taskmgr.exe 7781c1145869cdf87cf61d671247e80e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_259394796 7781c1145869cdf87cf61d671247e80e.exe -
Executes dropped EXE 3 IoCs
pid Process 3040 taskmgr.exe 3056 taskmgr.exe 2704 taskmgr.exe -
Loads dropped DLL 12 IoCs
pid Process 1044 7781c1145869cdf87cf61d671247e80e.exe 3040 taskmgr.exe 3040 taskmgr.exe 3040 taskmgr.exe 3040 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 3056 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe 2704 taskmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3040 set thread context of 3056 3040 taskmgr.exe 29 PID 3056 set thread context of 2704 3056 taskmgr.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3040 taskmgr.exe 3040 taskmgr.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 1044 wrote to memory of 3040 1044 7781c1145869cdf87cf61d671247e80e.exe 28 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3040 wrote to memory of 3056 3040 taskmgr.exe 29 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30 PID 3056 wrote to memory of 2704 3056 taskmgr.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7781c1145869cdf87cf61d671247e80e.exe"C:\Users\Admin\AppData\Local\Temp\7781c1145869cdf87cf61d671247e80e.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\Start Menu\Programs\Startup\taskmgr.exe"C:\Users\Admin\Start Menu\Programs\Startup\taskmgr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\Start Menu\Programs\Startup\taskmgr.exe"C:\Users\Admin\Start Menu\Programs\Startup\taskmgr.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\Start Menu\Programs\Startup\taskmgr.exemine.exe -a 59 -o http://hdzx.aquarium-stakany.org:8332/ -u redem_guild -p ludaxxxkxx4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
806KB
MD547cfdf331a80b2028a1b8aca61bd191b
SHA1d10bd40a735c6efbfa4fbfa6c842b4db5dba9445
SHA256c1a6cb5e7d001839c2ce9d368aacf34767867bce2309f9d28de95c7985a6cd1d
SHA5129ece7f127ddc29285214e7386951335719242a35001bc54c80aceb07c60f185b1eb6dce74a3b05760aec540888b529e73388f0d8ee26d4a41e3b54588e351a0d