Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe
Resource
win7-20240419-en
General
-
Target
beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe
-
Size
4.5MB
-
MD5
76544e1bdec1faf0479ba42233fab383
-
SHA1
c5010237c0da0750cacb6f6403a04becae34a8c8
-
SHA256
beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672
-
SHA512
3e4494956eb16e51108727eba4f4fbb52de731ae85f3ad9f79a33ba3a5a1c3f2b9917985cfbf6d881eeb40941a91b1c6e187748b2547eb4ad011f0ad3c3d00f4
-
SSDEEP
98304:uRTQjxogwN631p6FYskEhii/U20ygqGyJfKQrrjj/kllybHnXGa+UZT:hog56+skCdUUyg/EKHXGUZT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2720 wxrobot.exe -
Loads dropped DLL 2 IoCs
pid Process 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe -
resource yara_rule behavioral1/memory/1752-12-0x0000000000CB0000-0x0000000000CBB000-memory.dmp upx behavioral1/memory/2720-37-0x00000000003C0000-0x00000000003CB000-memory.dmp upx -
resource yara_rule behavioral1/memory/1752-5-0x0000000002BB0000-0x0000000002D7D000-memory.dmp vmprotect behavioral1/memory/1752-8-0x0000000002BB0000-0x0000000002D7D000-memory.dmp vmprotect behavioral1/memory/2720-30-0x0000000002DD0000-0x0000000002F9D000-memory.dmp vmprotect behavioral1/memory/2720-33-0x0000000002DD0000-0x0000000002F9D000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 2720 wxrobot.exe 2720 wxrobot.exe 2720 wxrobot.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~1\COMMON~1 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 2720 wxrobot.exe 2720 wxrobot.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2720 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 29 PID 1752 wrote to memory of 2720 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 29 PID 1752 wrote to memory of 2720 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 29 PID 1752 wrote to memory of 2720 1752 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe"C:\Users\Admin\AppData\Local\Temp\beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\wxrobot.exeC:\Users\Admin\AppData\Local\Temp\wxrobot.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD576544e1bdec1faf0479ba42233fab383
SHA1c5010237c0da0750cacb6f6403a04becae34a8c8
SHA256beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672
SHA5123e4494956eb16e51108727eba4f4fbb52de731ae85f3ad9f79a33ba3a5a1c3f2b9917985cfbf6d881eeb40941a91b1c6e187748b2547eb4ad011f0ad3c3d00f4