Analysis
-
max time kernel
197s -
max time network
287s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22-04-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe
Resource
win7-20240221-en
General
-
Target
1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe
-
Size
273KB
-
MD5
09b7c724534548986bb2110cf0902d76
-
SHA1
b94ad55a4b7c4c2c9d5a85c3426bbd8a54bfbcc8
-
SHA256
1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa
-
SHA512
42ff115546983093708a43909f1bf962741ab7ceca55b86892f4e85bd3b6071ef2bddadd8f0a51a4684c11f2fca988e58a26ad6567820990a3c243670182ea5f
-
SSDEEP
6144:VtwlK8rGFkFokzeQanr/6pNLCI8cQGz0nUMtY/uqqaO0:B8rGFkFP2upVC+zqUMtY/uq/O0
Malware Config
Extracted
xehook
https://unotree.ru/
https://aiwhcpoaw.ru/
Signatures
-
Detect Xehook Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3608-0-0x0000000000840000-0x0000000000888000-memory.dmp family_xehook behavioral2/memory/340-1-0x0000000000400000-0x000000000041C000-memory.dmp family_xehook behavioral2/memory/3608-2-0x0000000000840000-0x0000000000888000-memory.dmp family_xehook -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exedescription pid process target process PID 3608 set thread context of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 340 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exedescription pid process target process PID 3608 wrote to memory of 3604 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 3604 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 3604 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe PID 3608 wrote to memory of 340 3608 1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe"C:\Users\Admin\AppData\Local\Temp\1988e57588055c5e70ba3acc057888a03d33520ae86f74f95e6c2a9bcbf128aa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/340-1-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/340-3-0x00000000730F0000-0x00000000737DE000-memory.dmpFilesize
6.9MB
-
memory/340-4-0x0000000005B90000-0x000000000608E000-memory.dmpFilesize
5.0MB
-
memory/340-5-0x0000000006630000-0x00000000066C2000-memory.dmpFilesize
584KB
-
memory/340-6-0x0000000006860000-0x00000000068C6000-memory.dmpFilesize
408KB
-
memory/340-11-0x00000000730F0000-0x00000000737DE000-memory.dmpFilesize
6.9MB
-
memory/3608-0-0x0000000000840000-0x0000000000888000-memory.dmpFilesize
288KB
-
memory/3608-2-0x0000000000840000-0x0000000000888000-memory.dmpFilesize
288KB