stealthworker | 0f86e468ec6513a931bbc2b21070299348662cea4345c922d258a538115e32cf

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe
Size

2.3MB
MD5

71fb3ed4bf17e328c045a062fbf0895e
SHA1

cd4c819556e23a1919e9a8cf3d451455bf1696d7
SHA256

0f86e468ec6513a931bbc2b21070299348662cea4345c922d258a538115e32cf
SHA512

66b10b40604d42bf3bfb6cbd9f8def391293d63a6f5970cf25a1dcd8f714fafa3c7bbb0e855126abe466adc46baae6c5673619d894b17134d7fb8d0ac2485324
SSDEEP

49152:3hSC8yWCkKGisG73vpICdFlF3rKiyNutJTY3cN6qO1w9jQD:MC8PbLf05RrKiPY3Ie1Sj

Score

10^/10

stealthworker botnet upx

Malware Config

Extracted

Family

stealthworker

Version

3.11

http://176.121.14.113:8888

Signatures

StealthWorker
StealthWorker is golang-based brute force malware.
botnet stealthworker

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchoost .exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchoost .exe	cmd.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3624-3-0x0000000000400000-0x0000000000AE5000-memory.dmp	upx
behavioral2/memory/3624-9-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-13-0x0000000000400000-0x0000000000AE5000-memory.dmp	upx
behavioral2/memory/3624-14-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-15-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-17-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-18-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-19-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-20-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-21-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-23-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-24-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx
behavioral2/memory/3624-25-0x0000000000400000-0x0000000002FF8000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1292	3624	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	93
PID 3624 wrote to memory of 1292	3624	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	93
PID 3624 wrote to memory of 1292	3624	71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\71fb3ed4bf17e328c045a062fbf0895e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\cmd.exe
  cmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat
  2⤵
  - Drops startup file
  PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.bat

Filesize
305B

MD5
e593a419ad727b735f30513663ee6fce

SHA1
562e94e687430e5d8176395a4e460751ecfe54ec

SHA256
2a5ad4658dd2f3c2d9885edd0ff112965756064d40a4a8e38f7b1db72dad558d

SHA512
4c19f9d475215566ea681d1ab758d59c4f0a6189b0fc0a41f95c6560e5e6af1c0da8ba33c53bf46aaa7a31a704fe4b05c4e233c65f720ab4632db11c565d1976

Download Submit
memory/3624-14-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-11-0x0000000003750000-0x000000000396A000-memory.dmp

Filesize
2.1MB

Download
memory/3624-15-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-9-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-17-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-12-0x0000000003970000-0x0000000003B81000-memory.dmp

Filesize
2.1MB

Download
memory/3624-13-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/3624-18-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-2-0x0000000003970000-0x0000000003B81000-memory.dmp

Filesize
2.1MB

Download
memory/3624-3-0x0000000000400000-0x0000000000AE5000-memory.dmp

Filesize
6.9MB

Download
memory/3624-1-0x0000000003750000-0x000000000396A000-memory.dmp

Filesize
2.1MB

Download
memory/3624-19-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-20-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-21-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-23-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-24-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download
memory/3624-25-0x0000000000400000-0x0000000002FF8000-memory.dmp

Filesize
44.0MB

Download