Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe
Resource
win7-20240419-en
General
-
Target
beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe
-
Size
4.5MB
-
MD5
76544e1bdec1faf0479ba42233fab383
-
SHA1
c5010237c0da0750cacb6f6403a04becae34a8c8
-
SHA256
beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672
-
SHA512
3e4494956eb16e51108727eba4f4fbb52de731ae85f3ad9f79a33ba3a5a1c3f2b9917985cfbf6d881eeb40941a91b1c6e187748b2547eb4ad011f0ad3c3d00f4
-
SSDEEP
98304:uRTQjxogwN631p6FYskEhii/U20ygqGyJfKQrrjj/kllybHnXGa+UZT:hog56+skCdUUyg/EKHXGUZT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2780 wxrobot.exe -
resource yara_rule behavioral2/memory/4876-13-0x0000000002AB0000-0x0000000002ABB000-memory.dmp upx behavioral2/memory/2780-33-0x0000000002AA0000-0x0000000002AAB000-memory.dmp upx -
resource yara_rule behavioral2/memory/4876-5-0x0000000002BE0000-0x0000000002DAD000-memory.dmp vmprotect behavioral2/memory/4876-9-0x0000000002BE0000-0x0000000002DAD000-memory.dmp vmprotect behavioral2/memory/2780-26-0x0000000002CC0000-0x0000000002E8D000-memory.dmp vmprotect behavioral2/memory/2780-29-0x0000000002CC0000-0x0000000002E8D000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 2780 wxrobot.exe 2780 wxrobot.exe 2780 wxrobot.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~1\COMMON~1 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 2780 wxrobot.exe 2780 wxrobot.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4876 wrote to memory of 2780 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 89 PID 4876 wrote to memory of 2780 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 89 PID 4876 wrote to memory of 2780 4876 beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe"C:\Users\Admin\AppData\Local\Temp\beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\wxrobot.exeC:\Users\Admin\AppData\Local\Temp\wxrobot.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
MD576544e1bdec1faf0479ba42233fab383
SHA1c5010237c0da0750cacb6f6403a04becae34a8c8
SHA256beea1ddc31b23101043a9fcd847d896dd65eed4df163fdb9c36452812d798672
SHA5123e4494956eb16e51108727eba4f4fbb52de731ae85f3ad9f79a33ba3a5a1c3f2b9917985cfbf6d881eeb40941a91b1c6e187748b2547eb4ad011f0ad3c3d00f4