Resubmissions
16-05-2022 16:24
220516-twn54sddfp 10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 14:32
Static task
static1
Behavioral task
behavioral1
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win10v2004-20240412-en
General
-
Target
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
-
Size
222KB
-
MD5
72cfa33b978294103889481feca472f2
-
SHA1
0615eb31fd67345b9fa0d57d12a3bcb363152abe
-
SHA256
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
-
SHA512
d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
SSDEEP
3072:m04yjyyUD1HncBNyBNp5oEug4OkyJAQF1G8Xrrw+cC+lJDJEQkjvuMM:SR1HUUPCEZ4OkyJ9rrw+cZTuZSMM
Malware Config
Extracted
systembc
fanstat18.club:4044
dexblog90.club:4044
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ceau.execeau.exepid process 4904 ceau.exe 4012 ceau.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 57 api.ipify.org 58 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exedescription ioc process File opened for modification C:\Windows\Tasks\ceau.job 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe File created C:\Windows\Tasks\ceau.job 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4492 3924 WerFault.exe 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe 940 4904 WerFault.exe ceau.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exepid process 3924 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe 3924 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe"C:\Users\Admin\AppData\Local\Temp\5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 9482⤵
- Program crash
-
C:\ProgramData\onbmmx\ceau.exeC:\ProgramData\onbmmx\ceau.exe start21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 4842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3924 -ip 39241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4904 -ip 49041⤵
-
C:\ProgramData\onbmmx\ceau.exeC:\ProgramData\onbmmx\ceau.exe start21⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\onbmmx\ceau.exeFilesize
222KB
MD572cfa33b978294103889481feca472f2
SHA10615eb31fd67345b9fa0d57d12a3bcb363152abe
SHA2565d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
SHA512d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
memory/3924-1-0x00000000006E0000-0x00000000007E0000-memory.dmpFilesize
1024KB
-
memory/3924-2-0x0000000000670000-0x0000000000679000-memory.dmpFilesize
36KB
-
memory/3924-3-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/3924-14-0x00000000006E0000-0x00000000007E0000-memory.dmpFilesize
1024KB
-
memory/4012-30-0x0000000000780000-0x0000000000880000-memory.dmpFilesize
1024KB
-
memory/4012-31-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/4012-34-0x0000000000780000-0x0000000000880000-memory.dmpFilesize
1024KB
-
memory/4904-11-0x0000000000820000-0x0000000000920000-memory.dmpFilesize
1024KB
-
memory/4904-13-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/4904-12-0x0000000000730000-0x0000000000739000-memory.dmpFilesize
36KB
-
memory/4904-17-0x0000000000820000-0x0000000000920000-memory.dmpFilesize
1024KB