Analysis
-
max time kernel
24s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe
-
Size
4.5MB
-
MD5
1a4261cbca6e08e1d1db27e28f24f79f
-
SHA1
6dcadc198a6ca77fcca32f5241f880e7ca583739
-
SHA256
00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc
-
SHA512
d8490b3d3174b7865a457f9b38153a1d55f3c61f973561d0a7ce23bc45f74259107ee26866c5c43bc2f2adccf2f6af9738031fc72e2c5a5e71eab8b229ea6531
-
SSDEEP
49152:Ux/jPjDdnThMbhBQPjMv1rEp62/sHl9n3dGPyRWVnNYKTqLfdNoGYF3GI5IYvYp:Ux/TdnThzwvprHl537Qu9o2I5U1
Malware Config
Extracted
Family
aurora
C2
82.115.223.77:8081
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exedescription pid process target process PID 4780 set thread context of 3252 4780 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3988 4780 WerFault.exe 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exedescription pid process target process PID 4780 wrote to memory of 3252 4780 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe vbc.exe PID 4780 wrote to memory of 3252 4780 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe vbc.exe PID 4780 wrote to memory of 3252 4780 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe vbc.exe PID 4780 wrote to memory of 3252 4780 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe vbc.exe PID 4780 wrote to memory of 3252 4780 00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe"C:\Users\Admin\AppData\Local\Temp\00151824f029662701f6aa7b8e2f629193a5b186aff19b5abb9c68665bd456bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4780 -ip 47801⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3252-2-0x0000000000400000-0x0000000000876000-memory.dmpFilesize
4.5MB
-
memory/3252-11-0x0000000000400000-0x0000000000876000-memory.dmpFilesize
4.5MB
-
memory/3252-13-0x0000000000400000-0x0000000000876000-memory.dmpFilesize
4.5MB
-
memory/3252-12-0x0000000000400000-0x0000000000876000-memory.dmpFilesize
4.5MB
-
memory/3252-14-0x0000000000400000-0x0000000000876000-memory.dmpFilesize
4.5MB
-
memory/3252-15-0x0000000000400000-0x0000000000876000-memory.dmpFilesize
4.5MB
-
memory/4780-1-0x00000000009B8000-0x00000000009BA000-memory.dmpFilesize
8KB