Resubmissions
24-09-2022 21:20
220924-z6qdtaddbl 10Analysis
-
max time kernel
193s -
max time network
255s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
14-04-2024 12:44
Static task
static1
Behavioral task
behavioral1
Sample
5e6764534b3a1e4d3abacc4810b6985d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5e6764534b3a1e4d3abacc4810b6985d.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
5e6764534b3a1e4d3abacc4810b6985d.exe
Resource
win10v2004-20240412-en
General
-
Target
5e6764534b3a1e4d3abacc4810b6985d.exe
-
Size
740KB
-
MD5
5e6764534b3a1e4d3abacc4810b6985d
-
SHA1
f10ad287f126f577f197070453812a7e88c2cc52
-
SHA256
e7d3181ef643d77bb33fe328d1ea58f512b4f27c8e6ed71935a2e7548f2facc0
-
SHA512
532d2855e1b21433dbcc9c803f0538d99f6c3bddf0dd8321f552c7d16914dce4c2d2d3abd8028f45a4cf18109d430251d8fe8c63d30627e6fcc27d54cb42a188
-
SSDEEP
12288:az1bWgRkItsxHeYfpGcix2wytmyKsqVwoiFNoQEN5:+RkItsl7fofyKsqVwoiFNoQE3
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3800 2376 WerFault.exe 73 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe 2376 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2912 5e6764534b3a1e4d3abacc4810b6985d.exe 2376 wermgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2376 2912 5e6764534b3a1e4d3abacc4810b6985d.exe 73 PID 2912 wrote to memory of 2376 2912 5e6764534b3a1e4d3abacc4810b6985d.exe 73 PID 2912 wrote to memory of 2376 2912 5e6764534b3a1e4d3abacc4810b6985d.exe 73 PID 2912 wrote to memory of 2376 2912 5e6764534b3a1e4d3abacc4810b6985d.exe 73 PID 2912 wrote to memory of 2376 2912 5e6764534b3a1e4d3abacc4810b6985d.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6764534b3a1e4d3abacc4810b6985d.exe"C:\Users\Admin\AppData\Local\Temp\5e6764534b3a1e4d3abacc4810b6985d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\System32\wermgr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 9803⤵
- Program crash
PID:3800
-
-