Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe
Resource
win10v2004-20241007-en
General
-
Target
13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe
-
Size
225KB
-
MD5
24e544664a4517e54984b688ceeb7ee0
-
SHA1
d4d74bde5f67ea1af7b670cc79ccdfa27b728bc8
-
SHA256
13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365c
-
SHA512
34da12df40bf35584acd7b6b461b1d7fb9bdce9df6f9ab10c102c67f29126ffe34146acc76bed48841e808f3b978d4ad85182e5b118be575232a14d90b2dbed1
-
SSDEEP
6144:xA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:xATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\C668B1CD = "C:\\Users\\Admin\\AppData\\Roaming\\C668B1CD\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe 2780 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2780 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2780 1292 13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe 31 PID 1292 wrote to memory of 2780 1292 13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe 31 PID 1292 wrote to memory of 2780 1292 13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe 31 PID 1292 wrote to memory of 2780 1292 13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe 31 PID 1292 wrote to memory of 2780 1292 13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe 31 PID 2780 wrote to memory of 1208 2780 winver.exe 21 PID 2780 wrote to memory of 1120 2780 winver.exe 19 PID 2780 wrote to memory of 1176 2780 winver.exe 20 PID 2780 wrote to memory of 1208 2780 winver.exe 21 PID 2780 wrote to memory of 1288 2780 winver.exe 25 PID 2780 wrote to memory of 1292 2780 winver.exe 29
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe"C:\Users\Admin\AppData\Local\Temp\13823bf47a7a5698cb09288a0652a6433267ca5178645e9e0e875e8e5ce0365cN.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2780
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1288