Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20240214-en -
submitted
29/03/2024, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe
Resource
win10-20240214-en
windows10-1703-x64
Behavioral task
behavioral3
Sample
1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe
Resource
win11-20240221-en
windows11-21h2-x64
General
-
Target
1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe
-
Size
5.4MB
-
MD5
271f221a0ad5129831a6d8ce8c091b11
-
SHA1
7d2ffc0181fd1c733e2668ec90408b87c5903e91
-
SHA256
1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267
-
SHA512
507e4ebdd62a7eea4c2c65a7161e3f73d61dbbbcd664a4ddd521273403587bc775ef41e548541192d07ac61eb0c5636c96c0ba3329ec38bae5fbf0d8af57f991
-
SSDEEP
49152:0r8ZgqXcYZZRO3Mbgdw4grqFKjpAXds2r73aBWfj75EDGZv3iCStVTwiT3fV:9ZXcX3MMdRsSs2r28JEQdkNwE
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 2 Go-http-client/1.1 -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4652 wmic.exe Token: SeSecurityPrivilege 4652 wmic.exe Token: SeTakeOwnershipPrivilege 4652 wmic.exe Token: SeLoadDriverPrivilege 4652 wmic.exe Token: SeSystemProfilePrivilege 4652 wmic.exe Token: SeSystemtimePrivilege 4652 wmic.exe Token: SeProfSingleProcessPrivilege 4652 wmic.exe Token: SeIncBasePriorityPrivilege 4652 wmic.exe Token: SeCreatePagefilePrivilege 4652 wmic.exe Token: SeBackupPrivilege 4652 wmic.exe Token: SeRestorePrivilege 4652 wmic.exe Token: SeShutdownPrivilege 4652 wmic.exe Token: SeDebugPrivilege 4652 wmic.exe Token: SeSystemEnvironmentPrivilege 4652 wmic.exe Token: SeRemoteShutdownPrivilege 4652 wmic.exe Token: SeUndockPrivilege 4652 wmic.exe Token: SeManageVolumePrivilege 4652 wmic.exe Token: 33 4652 wmic.exe Token: 34 4652 wmic.exe Token: 35 4652 wmic.exe Token: 36 4652 wmic.exe Token: SeIncreaseQuotaPrivilege 4652 wmic.exe Token: SeSecurityPrivilege 4652 wmic.exe Token: SeTakeOwnershipPrivilege 4652 wmic.exe Token: SeLoadDriverPrivilege 4652 wmic.exe Token: SeSystemProfilePrivilege 4652 wmic.exe Token: SeSystemtimePrivilege 4652 wmic.exe Token: SeProfSingleProcessPrivilege 4652 wmic.exe Token: SeIncBasePriorityPrivilege 4652 wmic.exe Token: SeCreatePagefilePrivilege 4652 wmic.exe Token: SeBackupPrivilege 4652 wmic.exe Token: SeRestorePrivilege 4652 wmic.exe Token: SeShutdownPrivilege 4652 wmic.exe Token: SeDebugPrivilege 4652 wmic.exe Token: SeSystemEnvironmentPrivilege 4652 wmic.exe Token: SeRemoteShutdownPrivilege 4652 wmic.exe Token: SeUndockPrivilege 4652 wmic.exe Token: SeManageVolumePrivilege 4652 wmic.exe Token: 33 4652 wmic.exe Token: 34 4652 wmic.exe Token: 35 4652 wmic.exe Token: 36 4652 wmic.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2572 2248 1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe 73 PID 2248 wrote to memory of 2572 2248 1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe 73 PID 2572 wrote to memory of 4312 2572 cmd.exe 75 PID 2572 wrote to memory of 4312 2572 cmd.exe 75 PID 2248 wrote to memory of 4652 2248 1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe 76 PID 2248 wrote to memory of 4652 2248 1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe"C:\Users\Admin\AppData\Local\Temp\1cc04decdee0d7534f70675d6f2fad7baf631dbd8ac4fdf9403785e294ff1267.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\cmd.execmd /C chcp 650012⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4312
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652
-