Resubmissions
17-04-2024 12:47
240417-p1aq3ahc4w 1017-04-2024 12:47
240417-pz95jafg23 1017-04-2024 12:47
240417-pz9h1afg22 1017-04-2024 12:46
240417-pz56ksff97 1017-04-2024 12:46
240417-pz49aahc3t 1017-04-2024 06:16
240417-g1qhhsff94 10Analysis
-
max time kernel
299s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
17-04-2024 12:46
Behavioral task
behavioral1
Sample
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
Resource
win10v2004-20240226-en
General
-
Target
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
-
Size
221KB
-
MD5
364d59e179ebcd469dce4f231789732d
-
SHA1
bc86ba43147fe0d301a32b66193dd2930b8af1d2
-
SHA256
09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc
-
SHA512
92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe
-
SSDEEP
6144:0YlvDFWQtzoa2gUayZSSnBcaa5MKmtVgykK:BNtzPqUgkNM4
Malware Config
Extracted
systembc
yan0212.com:4039
yan0212.net:4039
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1112 twisf.exe -
resource yara_rule behavioral3/files/0x000800000001ac27-5.dat upx -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\twisf.job 09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe File opened for modification C:\Windows\Tasks\twisf.job 09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3988 09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe 3988 09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe"C:\Users\Admin\AppData\Local\Temp\09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
C:\ProgramData\aegkmoq\twisf.exeC:\ProgramData\aegkmoq\twisf.exe start1⤵
- Executes dropped EXE
PID:1112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD5364d59e179ebcd469dce4f231789732d
SHA1bc86ba43147fe0d301a32b66193dd2930b8af1d2
SHA25609800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc
SHA51292ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe