stealthworker | 0f86e468ec6513a931bbc2b21070299348662cea4345c922d258a538115e32cf

Analysis

max time kernel
140s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe
Size

2.3MB
MD5

71fb3ed4bf17e328c045a062fbf0895e
SHA1

cd4c819556e23a1919e9a8cf3d451455bf1696d7
SHA256

0f86e468ec6513a931bbc2b21070299348662cea4345c922d258a538115e32cf
SHA512

66b10b40604d42bf3bfb6cbd9f8def391293d63a6f5970cf25a1dcd8f714fafa3c7bbb0e855126abe466adc46baae6c5673619d894b17134d7fb8d0ac2485324
SSDEEP

49152:3hSC8yWCkKGisG73vpICdFlF3rKiyNutJTY3cN6qO1w9jQD:MC8PbLf05RrKiPY3Ie1Sj

Score

10^/10

stealthworker botnet upx

Malware Config

Extracted

Family

stealthworker

Version

3.11

http://176.121.14.113:8888

Signatures

StealthWorker
StealthWorker is golang-based brute force malware.
botnet stealthworker

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchoost .exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchoost .exe	cmd.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-6-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-7-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-9-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-11-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-12-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-14-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-15-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-16-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-17-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-18-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-20-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-21-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral1/memory/2104-22-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2260	2104	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	28
PID 2104 wrote to memory of 2260	2104	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	28
PID 2104 wrote to memory of 2260	2104	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	28
PID 2104 wrote to memory of 2260	2104	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
  2⤵
  - Drops startup file
  PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.bat

Filesize
305B

MD5
e593a419ad727b735f30513663ee6fce

SHA1
562e94e687430e5d8176395a4e460751ecfe54ec

SHA256
2a5ad4658dd2f3c2d9885edd0ff112965756064d40a4a8e38f7b1db72dad558d

SHA512
4c19f9d475215566ea681d1ab758d59c4f0a6189b0fc0a41f95c6560e5e6af1c0da8ba33c53bf46aaa7a31a704fe4b05c4e233c65f720ab4632db11c565d1976

Download Submit
memory/2104-14-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-15-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-6-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-7-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-9-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-11-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-5-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-0-0x00000000031D0000-0x00000000033E3000-memory.dmp

Filesize
2.1MB

Download
memory/2104-12-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-16-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-17-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-18-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-20-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-21-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/2104-22-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download