Analysis
- max time kernel
3s - max time network
49s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
09/05/2024, 23:13
General
- Target 8ddb2ac7260e57b2f20a55e30eb1b41595f38bf484b0a94e9495f3107c3bb913.exe
- Size 389KB
- Sample240509-27jc1aff76
- SHA256 8ddb2ac7260e57b2f20a55e30eb1b41595f38bf484b0a94e9495f3107c3bb913
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ddb2ac7260e57b2f20a55e30eb1b41595f38bf484b0a94e9495f3107c3bb913.exe"C:\Users\Admin\AppData\Local\Temp\8ddb2ac7260e57b2f20a55e30eb1b41595f38bf484b0a94e9495f3107c3bb913.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8ddb2ac7260e57b2f20a55e30eb1b41595f38bf484b0a94e9495f3107c3bb913.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
-
C:\Users\Admin\Pictures\bdavfZZFicdbKI1ZiLxprwnq.exe"C:\Users\Admin\Pictures\bdavfZZFicdbKI1ZiLxprwnq.exe"3⤵
-
-
C:\Users\Admin\Pictures\gcpmGhkakEXvIsjTVKXaehng.exe"C:\Users\Admin\Pictures\gcpmGhkakEXvIsjTVKXaehng.exe"3⤵
-
-
C:\Users\Admin\Pictures\mFQc9BZffjGz2LnGCGzJWet2.exe"C:\Users\Admin\Pictures\mFQc9BZffjGz2LnGCGzJWet2.exe"3⤵
-
-
C:\Users\Admin\Pictures\GCaJ5trckTwylOM9nXyJfmn6.exe"C:\Users\Admin\Pictures\GCaJ5trckTwylOM9nXyJfmn6.exe"3⤵
-
-
C:\Users\Admin\Pictures\LLdz0x5IMmw28muvo7o710FW.exe"C:\Users\Admin\Pictures\LLdz0x5IMmw28muvo7o710FW.exe"3⤵
-
-
C:\Users\Admin\Pictures\UCZGqLya6o9l5652wuXzUnPP.exe"C:\Users\Admin\Pictures\UCZGqLya6o9l5652wuXzUnPP.exe"3⤵
-
-
C:\Users\Admin\Pictures\FchBkh5BUJxrYdaCfzpA4Oxq.exe"C:\Users\Admin\Pictures\FchBkh5BUJxrYdaCfzpA4Oxq.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0mjondcn.5mi.ps1
BpKtAJmpkL8ilJcrPdppZ15u.exe
FchBkh5BUJxrYdaCfzpA4Oxq.exe
GCaJ5trckTwylOM9nXyJfmn6.exe
LLdz0x5IMmw28muvo7o710FW.exe
bdavfZZFicdbKI1ZiLxprwnq.exe
gcpmGhkakEXvIsjTVKXaehng.exe
memory/2284-49-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4184-0-0x00007FFBE0F83000-0x00007FFBE0F84000-memory.dmp
memory/4184-3-0x00007FFBE0F80000-0x00007FFBE196C000-memory.dmp
memory/4184-2-0x0000026AF92E0000-0x0000026AF933E000-memory.dmp
memory/4184-1-0x0000026ADED50000-0x0000026ADED5A000-memory.dmp
memory/4792-13-0x0000023BCF9F0000-0x0000023BCFA66000-memory.dmp
memory/4792-27-0x00007FFBE0F80000-0x00007FFBE196C000-memory.dmp
memory/4792-46-0x00007FFBE0F80000-0x00007FFBE196C000-memory.dmp
memory/4792-55-0x00007FFBE0F80000-0x00007FFBE196C000-memory.dmp
memory/4792-14-0x00007FFBE0F80000-0x00007FFBE196C000-memory.dmp
memory/4792-11-0x00007FFBE0F80000-0x00007FFBE196C000-memory.dmp
memory/4792-8-0x0000023BCED20000-0x0000023BCED42000-memory.dmp
memory/4892-116-0x0000000140000000-0x000000014097B000-memory.dmp