Analysis

  • max time kernel
    139s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 00:07

General

  • Target

    7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe

  • Size

    629KB

  • MD5

    793cfdff72eb3163f704c3f9b3b3c717

  • SHA1

    61534379b1cd8d8f8280b676972c28b30d7a0484

  • SHA256

    7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e

  • SHA512

    c4f532662fa063fd05a115e8a6c883204dbc2fab2c66378d448625d979a730d719d620bee3988bffec5bc4ea7bf46e6bafc0b0b1bcead0082f44ff834aa306ea

  • SSDEEP

    12288:0pdVfrKp5SBUOvkD/gKVGDHszAVXMG2n+z2x0K73AVdxGbw6H3MLVi:0pd9K7MlGXwz+AV8G2OpvcwL

Score
10/10

Malware Config

Signatures

  • AdWind

    A Java-based RAT family operated as malware-as-a-service.

  • Adwind family
  • Class file contains resources related to AdWind 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe
    "C:\Users\Admin\AppData\Local\Temp\7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\feesa.jar"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\feesa.jar

    Filesize

    639KB

    MD5

    f8efbadc189bc31378bb79f809418cbb

    SHA1

    b9d08cb99649523e96def357b3407d222422a42e

    SHA256

    b6c3ed6909c2cef457d966c5bb53e03d48467f05cc1c8c9d144a64f58db97554

    SHA512

    2e417e788928dc1f1e8db8268147db2ab830a621d6a893bdff153e5270ebbf152c77a5110ff9230371daff67cbd98eff4467858ebfa59629becfbfb56b11e501

  • memory/2856-41-0x000002DD4B5D0000-0x000002DD4B5E0000-memory.dmp

    Filesize

    64KB

  • memory/2856-51-0x000002DD4B5B0000-0x000002DD4B5C0000-memory.dmp

    Filesize

    64KB

  • memory/2856-58-0x000002DD4B5E0000-0x000002DD4B5F0000-memory.dmp

    Filesize

    64KB

  • memory/2856-56-0x000002DD4B5E0000-0x000002DD4B5F0000-memory.dmp

    Filesize

    64KB

  • memory/2856-42-0x000002DD4B2C0000-0x000002DD4B2C1000-memory.dmp

    Filesize

    4KB

  • memory/2856-25-0x000002DD4B560000-0x000002DD4B570000-memory.dmp

    Filesize

    64KB

  • memory/2856-24-0x000002DD4B550000-0x000002DD4B560000-memory.dmp

    Filesize

    64KB

  • memory/2856-27-0x000002DD4B570000-0x000002DD4B580000-memory.dmp

    Filesize

    64KB

  • memory/2856-30-0x000002DD4B580000-0x000002DD4B590000-memory.dmp

    Filesize

    64KB

  • memory/2856-31-0x000002DD4B590000-0x000002DD4B5A0000-memory.dmp

    Filesize

    64KB

  • memory/2856-33-0x000002DD4B5A0000-0x000002DD4B5B0000-memory.dmp

    Filesize

    64KB

  • memory/2856-35-0x000002DD4B5B0000-0x000002DD4B5C0000-memory.dmp

    Filesize

    64KB

  • memory/2856-53-0x000002DD4B5D0000-0x000002DD4B5E0000-memory.dmp

    Filesize

    64KB

  • memory/2856-37-0x000002DD4B5C0000-0x000002DD4B5D0000-memory.dmp

    Filesize

    64KB

  • memory/2856-10-0x000002DD4B2E0000-0x000002DD4B550000-memory.dmp

    Filesize

    2.4MB

  • memory/2856-43-0x000002DD4B2E0000-0x000002DD4B550000-memory.dmp

    Filesize

    2.4MB

  • memory/2856-44-0x000002DD4B550000-0x000002DD4B560000-memory.dmp

    Filesize

    64KB

  • memory/2856-45-0x000002DD4B560000-0x000002DD4B570000-memory.dmp

    Filesize

    64KB

  • memory/2856-46-0x000002DD4B2C0000-0x000002DD4B2C1000-memory.dmp

    Filesize

    4KB

  • memory/2856-47-0x000002DD4B570000-0x000002DD4B580000-memory.dmp

    Filesize

    64KB

  • memory/2856-48-0x000002DD4B580000-0x000002DD4B590000-memory.dmp

    Filesize

    64KB

  • memory/2856-49-0x000002DD4B590000-0x000002DD4B5A0000-memory.dmp

    Filesize

    64KB

  • memory/2856-50-0x000002DD4B5A0000-0x000002DD4B5B0000-memory.dmp

    Filesize

    64KB

  • memory/2856-52-0x000002DD4B5C0000-0x000002DD4B5D0000-memory.dmp

    Filesize

    64KB

  • memory/2920-0-0x00007FFF3DBE3000-0x00007FFF3DBE5000-memory.dmp

    Filesize

    8KB

  • memory/2920-4-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

    Filesize

    10.8MB

  • memory/2920-9-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

    Filesize

    10.8MB

  • memory/2920-1-0x0000000000D10000-0x0000000000DB4000-memory.dmp

    Filesize

    656KB