Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 07:53 UTC
Static task
static1
Behavioral task
behavioral1
Sample
d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe
Resource
win10v2004-20241007-en
General
-
Target
d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe
-
Size
64KB
-
MD5
b58497dea9ab8f91ec9c1c82ff8d1bcf
-
SHA1
dd48add5a7b8144fd8cd7b30b9288be03e52d4c3
-
SHA256
d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b
-
SHA512
8ce4de167ff5736c130ba7ef5f6dc464c8db2f913d4455abac0a5e6428cba7357601cf095664d0d931ecbb5fde67404854a873a1c9d72fc807ebb4e7cd4f28c3
-
SSDEEP
768:w3apPwO6xN5rD8T8X22eEmm6WulSv0yOPh7DuL6uNM6JiqrmehiVurmaBI3VVWI:vPel68XSEmjl/yYrfqjhzrmKIFAI
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\8BB55480 = "C:\\Users\\Admin\\AppData\\Roaming\\8BB55480\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe 2892 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2892 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2892 1464 d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe 31 PID 1464 wrote to memory of 2892 1464 d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe 31 PID 1464 wrote to memory of 2892 1464 d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe 31 PID 1464 wrote to memory of 2892 1464 d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe 31 PID 1464 wrote to memory of 2892 1464 d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe 31 PID 2892 wrote to memory of 1248 2892 winver.exe 21 PID 2892 wrote to memory of 1116 2892 winver.exe 19 PID 2892 wrote to memory of 1192 2892 winver.exe 20 PID 2892 wrote to memory of 1248 2892 winver.exe 21 PID 2892 wrote to memory of 1124 2892 winver.exe 23
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe"C:\Users\Admin\AppData\Local\Temp\d49746c2ed1ef5fa43ac220bfa9ba0340312f2832af2a4b2a06a2964d9a4089b.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2892
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1124
Network
-
Remote address:8.8.8.8:53Requestspaines.pwIN AResponsespaines.pwIN A216.218.185.162
-
Remote address:216.218.185.162:80RequestPOST /EiDQjNbWEQ/ HTTP/1.0
Host: spaines.pw
Content-Length: 157
ResponseHTTP/1.1 200 OK
Date: Fri, 22 Nov 2024 07:53:31 GMT
Content-Type: application/octet-stream
Connection: close
-
1.2kB 1.0kB 22 22
HTTP Request
POST http://spaines.pw/EiDQjNbWEQ/HTTP Response
200