Resubmissions
15-04-2024 11:39
240415-nshk9sdd73 1015-04-2024 11:39
240415-nshahafg41 1015-04-2024 11:39
240415-nsgnzadd72 1015-04-2024 11:39
240415-nsf3fadd69 1015-04-2024 11:39
240415-nsffxadd68 1010-04-2024 05:03
240410-fpndcadd29 1010-04-2024 05:02
240410-fph4madd28 1010-04-2024 05:02
240410-fphsvsge5z 1010-04-2024 05:02
240410-fphg4age5y 1008-02-2023 19:06
230208-xr3z9aef82 10Analysis
-
max time kernel
301s -
max time network
305s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-04-2024 05:02
Behavioral task
behavioral1
Sample
2579be109c1035cb96942951710020a8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2579be109c1035cb96942951710020a8.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
2579be109c1035cb96942951710020a8.exe
Resource
win10v2004-20240226-en
General
-
Target
2579be109c1035cb96942951710020a8.exe
-
Size
147KB
-
MD5
2579be109c1035cb96942951710020a8
-
SHA1
6987472967c8ce5e3d5fd6730a9da2964afacd10
-
SHA256
a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101
-
SHA512
191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21
-
SSDEEP
3072:9NuSXw/c4JHdNX8PAzCABaxg0r27f8EjQspDNJJAksa:9oSXw/hfNXmAzbYg02Ok
Malware Config
Extracted
systembc
advertspace10.club:4044
logstat17.club:4044
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
cmfg.exepid process 688 cmfg.exe -
Processes:
resource yara_rule behavioral4/memory/3932-0-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral4/memory/3932-2-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral4/memory/3932-4-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral4/memory/3932-7-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\ProgramData\gbaco\cmfg.exe upx behavioral4/memory/688-18-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral4/memory/688-22-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral4/memory/688-29-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org 5 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
2579be109c1035cb96942951710020a8.exedescription ioc process File created C:\Windows\Tasks\cmfg.job 2579be109c1035cb96942951710020a8.exe File opened for modification C:\Windows\Tasks\cmfg.job 2579be109c1035cb96942951710020a8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2579be109c1035cb96942951710020a8.exepid process 3932 2579be109c1035cb96942951710020a8.exe 3932 2579be109c1035cb96942951710020a8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2579be109c1035cb96942951710020a8.exe"C:\Users\Admin\AppData\Local\Temp\2579be109c1035cb96942951710020a8.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\gbaco\cmfg.exeC:\ProgramData\gbaco\cmfg.exe start21⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\gbaco\cmfg.exeFilesize
147KB
MD52579be109c1035cb96942951710020a8
SHA16987472967c8ce5e3d5fd6730a9da2964afacd10
SHA256a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101
SHA512191ea3d7edc69f1cb9d1ec4967074667c5e1c6b02fdaa8bbc5a4414bf5ca00ccafadc49670c5b3065133915d78e482572545f1d0c8c3382e6a767c1f08a33a21
-
memory/688-31-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/688-30-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/688-29-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/688-22-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/688-18-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/688-16-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/3932-4-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3932-10-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3932-9-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3932-8-0x00000000032E0000-0x0000000003314000-memory.dmpFilesize
208KB
-
memory/3932-7-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3932-0-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3932-2-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3932-1-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB