Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 10:22
Static task
static1
Behavioral task
behavioral1
Sample
deee27d22505bd8e59a238ff922df2ff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
deee27d22505bd8e59a238ff922df2ff.exe
Resource
win10v2004-20240226-en
General
-
Target
deee27d22505bd8e59a238ff922df2ff.exe
-
Size
2.0MB
-
MD5
deee27d22505bd8e59a238ff922df2ff
-
SHA1
b7a84ce3b528852afd40f2bd980c7eb2651c581d
-
SHA256
8ff6efab7b7b9a8e05edf2a88e6ba3e6d5c0130794c1c6fddcde7ccfb024e6eb
-
SHA512
ec4d7d38c4b6b4a62ea9361a5b4d7c315ab8b523b35bc67774f554897a3ba7fd295d2827de8dc1c03da72b400618d48af787ecbcc81d851227e58145ae05026e
-
SSDEEP
49152:JXyPwqt9nptBilanQvg4zLW1ZzKvKidr1pX0osvQ4H4444C:EP/pt7QhzMOhn0oiQ4H4444C
Malware Config
Extracted
bitrat
1.38
jairoandresotalvarorend.linkpc.net:9085
-
communication_password
bfdba24ee3d61f0260c4dc1034c3ee43
-
install_dir
Googlechromeinite
-
install_file
Googlechromeinit.exe
-
tor_process
tor
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/1420-7-0x00000000056D0000-0x00000000056E2000-memory.dmp CustAttr -
Processes:
resource yara_rule behavioral2/memory/464-12-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-13-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-15-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-16-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-17-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-19-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-21-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-23-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-22-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-24-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-25-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-26-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-27-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-29-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-31-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-30-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-33-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/464-34-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Googlechromeinit = "C:\\Users\\Admin\\AppData\\Local\\Googlechromeinite\\Googlechromeinit.exe" deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exepid process 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription pid process target process PID 1420 set thread context of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious behavior: RenamesItself 19 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exepid process 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription pid process Token: SeShutdownPrivilege 464 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exepid process 464 deee27d22505bd8e59a238ff922df2ff.exe 464 deee27d22505bd8e59a238ff922df2ff.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
deee27d22505bd8e59a238ff922df2ff.exedescription pid process target process PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe PID 1420 wrote to memory of 464 1420 deee27d22505bd8e59a238ff922df2ff.exe deee27d22505bd8e59a238ff922df2ff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"C:\Users\Admin\AppData\Local\Temp\deee27d22505bd8e59a238ff922df2ff.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/464-25-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-27-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-35-0x00000000740B0000-0x00000000740E9000-memory.dmpFilesize
228KB
-
memory/464-17-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-33-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-19-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-32-0x00000000740B0000-0x00000000740E9000-memory.dmpFilesize
228KB
-
memory/464-30-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-31-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-29-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-28-0x00000000740B0000-0x00000000740E9000-memory.dmpFilesize
228KB
-
memory/464-22-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-12-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-13-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-15-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-16-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-34-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-26-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-24-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-20-0x00000000743F0000-0x0000000074429000-memory.dmpFilesize
228KB
-
memory/464-21-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/464-23-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1420-9-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/1420-5-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/1420-0-0x00000000744E0000-0x0000000074C90000-memory.dmpFilesize
7.7MB
-
memory/1420-3-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/1420-11-0x00000000085E0000-0x000000000875C000-memory.dmpFilesize
1.5MB
-
memory/1420-10-0x0000000008340000-0x0000000008504000-memory.dmpFilesize
1.8MB
-
memory/1420-1-0x0000000000690000-0x0000000000892000-memory.dmpFilesize
2.0MB
-
memory/1420-8-0x00000000744E0000-0x0000000074C90000-memory.dmpFilesize
7.7MB
-
memory/1420-7-0x00000000056D0000-0x00000000056E2000-memory.dmpFilesize
72KB
-
memory/1420-6-0x0000000005290000-0x000000000529A000-memory.dmpFilesize
40KB
-
memory/1420-4-0x0000000005370000-0x000000000540C000-memory.dmpFilesize
624KB
-
memory/1420-18-0x00000000744E0000-0x0000000074C90000-memory.dmpFilesize
7.7MB
-
memory/1420-2-0x0000000005920000-0x0000000005EC4000-memory.dmpFilesize
5.6MB