Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2024 02:40
Behavioral task
behavioral1
Sample
d7ad4cf42e2f520b0ef1ef910eb9186b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d7ad4cf42e2f520b0ef1ef910eb9186b.exe
Resource
win10v2004-20240226-en
General
-
Target
d7ad4cf42e2f520b0ef1ef910eb9186b.exe
-
Size
4.0MB
-
MD5
d7ad4cf42e2f520b0ef1ef910eb9186b
-
SHA1
33a097621828dfc287753aa33d954ef755978c3d
-
SHA256
8e09a7c18a858ec70aaa9c69788e8b9e7dffa134cf3bb868c28229e7bf4b9e9e
-
SHA512
8f3e0eaadc5be76e25cd3dd4c8b7ca13b30aa0dbb86b4d4ced212c0f1a4b2ed196c1dbd1a81f9a1f535a0b4d354c3ba0c1bf5e1cc55d11e3026236c0c922912d
-
SSDEEP
49152:HXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VIg:HXrEeZzdhjuV/gd1VzsGUqNKTHvQeeJ
Malware Config
Extracted
bitrat
1.35
185.157.162.100:58181
-
communication_password
d4fab64cc4b3bcd4e84db4020ebb3c66
-
install_dir
Microsoft
-
install_file
micros.exe
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4300-0-0x0000000000400000-0x0000000000808000-memory.dmp upx behavioral2/memory/4300-4-0x0000000000400000-0x0000000000808000-memory.dmp upx -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
d7ad4cf42e2f520b0ef1ef910eb9186b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exe\u3000" d7ad4cf42e2f520b0ef1ef910eb9186b.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exe瘀" d7ad4cf42e2f520b0ef1ef910eb9186b.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exe頀" d7ad4cf42e2f520b0ef1ef910eb9186b.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exe儀" d7ad4cf42e2f520b0ef1ef910eb9186b.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exe" d7ad4cf42e2f520b0ef1ef910eb9186b.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exe匀" d7ad4cf42e2f520b0ef1ef910eb9186b.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\micros = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\micros.exeԀ" d7ad4cf42e2f520b0ef1ef910eb9186b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
d7ad4cf42e2f520b0ef1ef910eb9186b.exepid process 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe -
Suspicious behavior: RenamesItself 30 IoCs
Processes:
d7ad4cf42e2f520b0ef1ef910eb9186b.exepid process 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d7ad4cf42e2f520b0ef1ef910eb9186b.exedescription pid process Token: SeShutdownPrivilege 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d7ad4cf42e2f520b0ef1ef910eb9186b.exepid process 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe 4300 d7ad4cf42e2f520b0ef1ef910eb9186b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7ad4cf42e2f520b0ef1ef910eb9186b.exe"C:\Users\Admin\AppData\Local\Temp\d7ad4cf42e2f520b0ef1ef910eb9186b.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4300-0-0x0000000000400000-0x0000000000808000-memory.dmpFilesize
4.0MB
-
memory/4300-1-0x0000000074CA0000-0x0000000074CD9000-memory.dmpFilesize
228KB
-
memory/4300-2-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-3-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-4-0x0000000000400000-0x0000000000808000-memory.dmpFilesize
4.0MB
-
memory/4300-5-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-6-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-7-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-8-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-9-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB
-
memory/4300-10-0x0000000075040000-0x0000000075079000-memory.dmpFilesize
228KB