Analysis
-
max time kernel
1778s -
max time network
1147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 10:30
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
1800 seconds
General
-
Target
main.exe
-
Size
21.6MB
-
MD5
d3da622e37697ac28732a3f32f81f724
-
SHA1
783a3f7dd983bbd00630c3cf3bbd9e4f3d5cde9f
-
SHA256
2c8da4a1992431904b1689179b67b23b37a7a2d1615a56108a30e3adc46dbe29
-
SHA512
47ae5fffd82d37451dfd62e484dce4d7536761702b9ea41254f36a28b65f8e87104de11d13566fdc99b4e933514486465c2c6354a46645c1a8a17ee4d28506e1
-
SSDEEP
393216:RLFXlr1pwde9TQDyRTDOEfYGig9/MM9NJyIp0ijyhq5aqi7w0:dFXN1dQDyAZNM9TrGMtg
Malware Config
Signatures
-
Loads dropped DLL 24 IoCs
Processes:
main.exepid Process 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe 1224 main.exe -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 74 whatismyipaddress.com 78 whatismyipaddress.com 79 whatismyipaddress.com 80 whatismyipaddress.com 81 whatismyipaddress.com 82 whatismyipaddress.com 83 whatismyipaddress.com -
Processes:
resource yara_rule behavioral2/files/0x0007000000023ca5-98.dat upx behavioral2/memory/1224-102-0x00007FFA48320000-0x00007FFA4878E000-memory.dmp upx behavioral2/files/0x0007000000023c70-104.dat upx behavioral2/memory/1224-110-0x00007FFA5CEE0000-0x00007FFA5CF04000-memory.dmp upx behavioral2/files/0x0007000000023c87-109.dat upx behavioral2/memory/1224-112-0x00007FFA61790000-0x00007FFA6179F000-memory.dmp upx behavioral2/files/0x0007000000023c6e-113.dat upx behavioral2/memory/1224-115-0x00007FFA5FB80000-0x00007FFA5FB99000-memory.dmp upx behavioral2/files/0x0007000000023c73-116.dat upx behavioral2/memory/1224-119-0x00007FFA5CF50000-0x00007FFA5CF7D000-memory.dmp upx behavioral2/files/0x0007000000023ca3-118.dat upx behavioral2/memory/1224-122-0x00007FFA5CF10000-0x00007FFA5CF44000-memory.dmp upx behavioral2/files/0x0007000000023c77-121.dat upx behavioral2/files/0x0007000000023ca8-126.dat upx behavioral2/memory/1224-128-0x00007FFA61520000-0x00007FFA6152D000-memory.dmp upx behavioral2/files/0x0007000000023c76-129.dat upx behavioral2/files/0x0007000000023ca7-130.dat upx behavioral2/files/0x0007000000023ca6-135.dat upx behavioral2/memory/1224-136-0x00007FFA5CEA0000-0x00007FFA5CECE000-memory.dmp upx behavioral2/memory/1224-134-0x00007FFA5CED0000-0x00007FFA5CEDD000-memory.dmp upx behavioral2/memory/1224-125-0x00007FFA5DC00000-0x00007FFA5DC19000-memory.dmp upx behavioral2/memory/1224-139-0x00007FFA5CEE0000-0x00007FFA5CF04000-memory.dmp upx behavioral2/memory/1224-140-0x00007FFA5A000000-0x00007FFA5A0BC000-memory.dmp upx behavioral2/memory/1224-138-0x00007FFA48320000-0x00007FFA4878E000-memory.dmp upx behavioral2/files/0x0007000000023caa-141.dat upx behavioral2/memory/1224-143-0x00007FFA5CE60000-0x00007FFA5CE8B000-memory.dmp upx behavioral2/files/0x0007000000023c71-146.dat upx behavioral2/memory/1224-149-0x00007FFA58540000-0x00007FFA58582000-memory.dmp upx behavioral2/memory/1224-148-0x00007FFA61790000-0x00007FFA6179F000-memory.dmp upx behavioral2/files/0x0007000000023c79-150.dat upx behavioral2/memory/1224-153-0x00007FFA5FB80000-0x00007FFA5FB99000-memory.dmp upx behavioral2/memory/1224-154-0x00007FFA58C30000-0x00007FFA58C3A000-memory.dmp upx behavioral2/files/0x0007000000023ca2-155.dat upx behavioral2/memory/1224-157-0x00007FFA58C10000-0x00007FFA58C2C000-memory.dmp upx behavioral2/files/0x0007000000023c78-156.dat upx behavioral2/memory/1224-160-0x00007FFA583F0000-0x00007FFA5841E000-memory.dmp upx behavioral2/files/0x0007000000023c88-161.dat upx behavioral2/files/0x0007000000023c86-159.dat upx behavioral2/memory/1224-163-0x00007FFA5DC00000-0x00007FFA5DC19000-memory.dmp upx behavioral2/memory/1224-165-0x00007FFA47FA0000-0x00007FFA48315000-memory.dmp upx behavioral2/memory/1224-166-0x00007FFA57D60000-0x00007FFA57E18000-memory.dmp upx behavioral2/files/0x0007000000023c72-167.dat upx behavioral2/memory/1224-169-0x00007FFA58380000-0x00007FFA58394000-memory.dmp upx behavioral2/files/0x0007000000023ca9-170.dat upx behavioral2/memory/1224-173-0x00007FFA57790000-0x00007FFA578A8000-memory.dmp upx behavioral2/memory/1224-172-0x00007FFA5CEA0000-0x00007FFA5CECE000-memory.dmp upx behavioral2/memory/1224-174-0x00007FFA5A000000-0x00007FFA5A0BC000-memory.dmp upx behavioral2/memory/1224-191-0x00007FFA47FA0000-0x00007FFA48315000-memory.dmp upx behavioral2/memory/1224-188-0x00007FFA58C30000-0x00007FFA58C3A000-memory.dmp upx behavioral2/memory/1224-197-0x00007FFA57790000-0x00007FFA578A8000-memory.dmp upx behavioral2/memory/1224-196-0x00007FFA58380000-0x00007FFA58394000-memory.dmp upx behavioral2/memory/1224-195-0x00007FFA57D60000-0x00007FFA57E18000-memory.dmp upx behavioral2/memory/1224-187-0x00007FFA58540000-0x00007FFA58582000-memory.dmp upx behavioral2/memory/1224-186-0x00007FFA5CE60000-0x00007FFA5CE8B000-memory.dmp upx behavioral2/memory/1224-185-0x00007FFA5A000000-0x00007FFA5A0BC000-memory.dmp upx behavioral2/memory/1224-184-0x00007FFA5CEA0000-0x00007FFA5CECE000-memory.dmp upx behavioral2/memory/1224-183-0x00007FFA5CED0000-0x00007FFA5CEDD000-memory.dmp upx behavioral2/memory/1224-182-0x00007FFA61520000-0x00007FFA6152D000-memory.dmp upx behavioral2/memory/1224-181-0x00007FFA5DC00000-0x00007FFA5DC19000-memory.dmp upx behavioral2/memory/1224-180-0x00007FFA5CF10000-0x00007FFA5CF44000-memory.dmp upx behavioral2/memory/1224-179-0x00007FFA5CF50000-0x00007FFA5CF7D000-memory.dmp upx behavioral2/memory/1224-178-0x00007FFA5FB80000-0x00007FFA5FB99000-memory.dmp upx behavioral2/memory/1224-177-0x00007FFA61790000-0x00007FFA6179F000-memory.dmp upx behavioral2/memory/1224-176-0x00007FFA5CEE0000-0x00007FFA5CF04000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exesetup.exedescription ioc Process File opened for modification C:\Program Files\Crashpad\metadata setup.exe File opened for modification C:\Program Files\Crashpad\settings.dat setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133733754226178661" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid Process 2868 chrome.exe 2868 chrome.exe -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
pid Process 4