Analysis
- max time kernel
139s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
05/11/2024, 00:07
General
- Target 7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe
- Size 629KB
- Sample241105-aef9dsspem
- SHA256 7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e
Malware Config
Signatures
- AdWind
A Java-based RAT family operated as malware-as-a-service.
- Adwind family
- Class file contains resources related to AdWind 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe"C:\Users\Admin\AppData\Local\Temp\7808c4be131e543caf2e9631b4c0662dc3dc9bab48b558fd8aab81190aa9ea2e.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\feesa.jar"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
feesa.jar
memory/2856-41-0x000002DD4B5D0000-0x000002DD4B5E0000-memory.dmp
memory/2856-51-0x000002DD4B5B0000-0x000002DD4B5C0000-memory.dmp
memory/2856-58-0x000002DD4B5E0000-0x000002DD4B5F0000-memory.dmp
memory/2856-56-0x000002DD4B5E0000-0x000002DD4B5F0000-memory.dmp
memory/2856-42-0x000002DD4B2C0000-0x000002DD4B2C1000-memory.dmp
memory/2856-25-0x000002DD4B560000-0x000002DD4B570000-memory.dmp
memory/2856-24-0x000002DD4B550000-0x000002DD4B560000-memory.dmp
memory/2856-27-0x000002DD4B570000-0x000002DD4B580000-memory.dmp
memory/2856-30-0x000002DD4B580000-0x000002DD4B590000-memory.dmp
memory/2856-31-0x000002DD4B590000-0x000002DD4B5A0000-memory.dmp
memory/2856-33-0x000002DD4B5A0000-0x000002DD4B5B0000-memory.dmp
memory/2856-35-0x000002DD4B5B0000-0x000002DD4B5C0000-memory.dmp
memory/2856-53-0x000002DD4B5D0000-0x000002DD4B5E0000-memory.dmp
memory/2856-37-0x000002DD4B5C0000-0x000002DD4B5D0000-memory.dmp
memory/2856-10-0x000002DD4B2E0000-0x000002DD4B550000-memory.dmp
memory/2856-43-0x000002DD4B2E0000-0x000002DD4B550000-memory.dmp
memory/2856-44-0x000002DD4B550000-0x000002DD4B560000-memory.dmp
memory/2856-45-0x000002DD4B560000-0x000002DD4B570000-memory.dmp
memory/2856-46-0x000002DD4B2C0000-0x000002DD4B2C1000-memory.dmp
memory/2856-47-0x000002DD4B570000-0x000002DD4B580000-memory.dmp
memory/2856-48-0x000002DD4B580000-0x000002DD4B590000-memory.dmp
memory/2856-49-0x000002DD4B590000-0x000002DD4B5A0000-memory.dmp
memory/2856-50-0x000002DD4B5A0000-0x000002DD4B5B0000-memory.dmp
memory/2856-52-0x000002DD4B5C0000-0x000002DD4B5D0000-memory.dmp
memory/2920-0-0x00007FFF3DBE3000-0x00007FFF3DBE5000-memory.dmp
memory/2920-4-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp
memory/2920-9-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp
memory/2920-1-0x0000000000D10000-0x0000000000DB4000-memory.dmp