Resubmissions
16-05-2022 16:24
220516-twn54sddfp 10Analysis
-
max time kernel
1199s -
max time network
1200s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 14:32
Static task
static1
Behavioral task
behavioral1
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
Resource
win10v2004-20240412-en
General
-
Target
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe
-
Size
222KB
-
MD5
72cfa33b978294103889481feca472f2
-
SHA1
0615eb31fd67345b9fa0d57d12a3bcb363152abe
-
SHA256
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
-
SHA512
d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
SSDEEP
3072:m04yjyyUD1HncBNyBNp5oEug4OkyJAQF1G8Xrrw+cC+lJDJEQkjvuMM:SR1HUUPCEZ4OkyJ9rrw+cZTuZSMM
Malware Config
Extracted
systembc
fanstat18.club:4044
dexblog90.club:4044
Signatures
-
Contacts a large (615) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
Processes:
raehob.exeraehob.exepid process 2544 raehob.exe 2124 raehob.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip4.seeip.org 5 api.ipify.org 6 api.ipify.org 7 ip4.seeip.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
Processes:
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exedescription ioc process File opened for modification C:\Windows\Tasks\raehob.job 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe File created C:\Windows\Tasks\raehob.job 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exepid process 2856 5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exedescription pid process target process PID 2492 wrote to memory of 2544 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2544 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2544 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2544 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2124 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2124 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2124 2492 taskeng.exe raehob.exe PID 2492 wrote to memory of 2124 2492 taskeng.exe raehob.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe"C:\Users\Admin\AppData\Local\Temp\5d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {6896AD04-3703-4578-BAAF-D82A808D159E} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\hjln\raehob.exeC:\ProgramData\hjln\raehob.exe start22⤵
- Executes dropped EXE
-
C:\ProgramData\hjln\raehob.exeC:\ProgramData\hjln\raehob.exe start22⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hjln\raehob.exeFilesize
222KB
MD572cfa33b978294103889481feca472f2
SHA10615eb31fd67345b9fa0d57d12a3bcb363152abe
SHA2565d366decba2f9078f457cb35fe7bfd198760683a709f0d33745fc6e0ba59ac8a
SHA512d1de5fee23b7a858ec62b849cd8a41cf896ab8b6df4836c65ba36942c1d1727b36832d45713a578c93e8a0b8650bf55923568637d91bb9b2196257a2ae015559
-
memory/2124-29-0x0000000000540000-0x0000000000640000-memory.dmpFilesize
1024KB
-
memory/2124-30-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2124-33-0x0000000000540000-0x0000000000640000-memory.dmpFilesize
1024KB
-
memory/2544-11-0x00000000005C0000-0x00000000006C0000-memory.dmpFilesize
1024KB
-
memory/2544-12-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2544-18-0x00000000005C0000-0x00000000006C0000-memory.dmpFilesize
1024KB
-
memory/2856-1-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/2856-2-0x00000000001B0000-0x00000000001B9000-memory.dmpFilesize
36KB
-
memory/2856-3-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2856-13-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB