Resubmissions
18-04-2024 05:25
240418-f4hreadf5z 1018-04-2024 05:25
240418-f4fl2scd33 1018-04-2024 05:25
240418-f4fbaadf5v 1018-04-2024 05:25
240418-f4edzscd32 1018-04-2024 05:25
240418-f4dsfscd29 10Analysis
-
max time kernel
1802s -
max time network
1807s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 05:25
Static task
static1
Behavioral task
behavioral1
Sample
fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
Resource
win10v2004-20240412-en
General
-
Target
fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
-
Size
121KB
-
MD5
2140899e877c2bb95f71f77c31e205ce
-
SHA1
b7322db66f0c4b5a48c10ca3213b899131045d11
-
SHA256
fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20
-
SHA512
6856af4f8cb1fceede24360c7e081e6beea701a44b80e6276db719e5cba3b6cf5f7fae8df4ce56852ea34e73dfa4e091a8ac258d1efb596e0d7224b33402fe07
-
SSDEEP
1536:R7YvZGrzMeJILNJMuxyBye/DB79CTi+Ey7c3Ul4kfQuk2RGiXqp64:KvZ8NSLP60e/FeRhTfXrRGN64
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 464 neiujoj.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 87.236.195.203 -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 47 api.ipify.org 48 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\neiujoj.job fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe File opened for modification C:\Windows\Tasks\neiujoj.job fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 1936 1588 WerFault.exe 89 3088 1588 WerFault.exe 89 4888 1588 WerFault.exe 89 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1588 fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe 1588 fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe"C:\Users\Admin\AppData\Local\Temp\fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 9242⤵
- Program crash
PID:1936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 9322⤵
- Program crash
PID:3088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 9682⤵
- Program crash
PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1016,i,4190291444332669241,12594774403502447104,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:81⤵PID:3080
-
C:\ProgramData\ixoaktg\neiujoj.exeC:\ProgramData\ixoaktg\neiujoj.exe start1⤵
- Executes dropped EXE
PID:464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1588 -ip 15881⤵PID:4248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1588 -ip 15881⤵PID:3076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1588 -ip 15881⤵PID:3376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3884,i,4190291444332669241,12594774403502447104,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:81⤵PID:4300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD52140899e877c2bb95f71f77c31e205ce
SHA1b7322db66f0c4b5a48c10ca3213b899131045d11
SHA256fdc98ea3381d04350e38b592c2c63090d6f0bd32388a21fcfc5b7bfcb9753d20
SHA5126856af4f8cb1fceede24360c7e081e6beea701a44b80e6276db719e5cba3b6cf5f7fae8df4ce56852ea34e73dfa4e091a8ac258d1efb596e0d7224b33402fe07