Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 21:44
Static task
static1
Behavioral task
behavioral1
Sample
a76da3ab31bd142881d3cc05b3903dba.exe
Resource
win7-20240221-en
General
-
Target
a76da3ab31bd142881d3cc05b3903dba.exe
-
Size
1.9MB
-
MD5
a76da3ab31bd142881d3cc05b3903dba
-
SHA1
8b168865e07098254456c4bde49f0892e42ae2b1
-
SHA256
84c32cb403361a5d8d8117cf941b89c6c819ac453a0e1f411eb5c2952cc35e7c
-
SHA512
064a326303e24160ef5a27fa4843d98c1df545e5bcd077b25dfd1abd5cb7ee7a142edf4176a16ff0972ebcaada9604cd23ee14c01251c223336260669a010fff
-
SSDEEP
24576:CjmjQcndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkziEmTxp+x:vQmXDFBU2iIBb0xY/6sUYYRLDIP
Malware Config
Extracted
bitrat
1.38
79.134.225.90:4898
-
communication_password
7fcc5163240be484c36ebae222f656b3
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a76da3ab31bd142881d3cc05b3903dba.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation a76da3ab31bd142881d3cc05b3903dba.exe -
Executes dropped EXE 2 IoCs
Processes:
q4uzSzYG8duzleN3.exeq4uzSzYG8duzleN3.exepid process 3892 q4uzSzYG8duzleN3.exe 4504 q4uzSzYG8duzleN3.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\q4uzSzYG8duzleN3.exe upx behavioral2/memory/3892-8-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4504-10-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4504-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-17-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-20-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-37-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-40-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-41-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-49-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/3892-51-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
q4uzSzYG8duzleN3.exeq4uzSzYG8duzleN3.exepid process 3892 q4uzSzYG8duzleN3.exe 4504 q4uzSzYG8duzleN3.exe 3892 q4uzSzYG8duzleN3.exe 3892 q4uzSzYG8duzleN3.exe 3892 q4uzSzYG8duzleN3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
q4uzSzYG8duzleN3.exeq4uzSzYG8duzleN3.exedescription pid process Token: SeShutdownPrivilege 3892 q4uzSzYG8duzleN3.exe Token: SeShutdownPrivilege 4504 q4uzSzYG8duzleN3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
q4uzSzYG8duzleN3.exepid process 3892 q4uzSzYG8duzleN3.exe 3892 q4uzSzYG8duzleN3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a76da3ab31bd142881d3cc05b3903dba.exedescription pid process target process PID 4976 wrote to memory of 3892 4976 a76da3ab31bd142881d3cc05b3903dba.exe q4uzSzYG8duzleN3.exe PID 4976 wrote to memory of 3892 4976 a76da3ab31bd142881d3cc05b3903dba.exe q4uzSzYG8duzleN3.exe PID 4976 wrote to memory of 3892 4976 a76da3ab31bd142881d3cc05b3903dba.exe q4uzSzYG8duzleN3.exe PID 4976 wrote to memory of 4504 4976 a76da3ab31bd142881d3cc05b3903dba.exe q4uzSzYG8duzleN3.exe PID 4976 wrote to memory of 4504 4976 a76da3ab31bd142881d3cc05b3903dba.exe q4uzSzYG8duzleN3.exe PID 4976 wrote to memory of 4504 4976 a76da3ab31bd142881d3cc05b3903dba.exe q4uzSzYG8duzleN3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a76da3ab31bd142881d3cc05b3903dba.exe"C:\Users\Admin\AppData\Local\Temp\a76da3ab31bd142881d3cc05b3903dba.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\q4uzSzYG8duzleN3.exe"C:\Users\Admin\AppData\Local\Temp\q4uzSzYG8duzleN3.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\q4uzSzYG8duzleN3.exe"C:\Users\Admin\AppData\Local\Temp\q4uzSzYG8duzleN3.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\q4uzSzYG8duzleN3.exeFilesize
1.4MB
MD560b16295c2f7b34128b7135af220c142
SHA1a2211b6e1d2708316c3086398df6d56a52494d5e
SHA256e8cb7abe387fa940a5b97a00b50f30ddb613dbd31beae4005dee56232c7fb1b8
SHA5123e0000a5ca8e5e797974145e50ab1213b0d8e4ecfaf38fa711f58c8836f13edd86b93aaf1e70a6f494cf87d676d2598f49f91adcbea66b2ec9816c14b270d996
-
memory/3892-21-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-49-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-11-0x00000000743A0000-0x00000000743D9000-memory.dmpFilesize
228KB
-
memory/3892-20-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-50-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-14-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-15-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-16-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-17-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-19-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-51-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-8-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-34-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-33-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-31-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-36-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-37-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-39-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/3892-40-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-41-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/3892-48-0x00000000748E0000-0x0000000074919000-memory.dmpFilesize
228KB
-
memory/4504-10-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4504-13-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4504-12-0x0000000074200000-0x0000000074239000-memory.dmpFilesize
228KB