Analysis

  • max time kernel
    105s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 02:13

General

  • Target

    154ebc6e51d30fc88bd92b19485cbabfaab3526b71ad36d78c40e4612943c03fN.exe

  • Size

    237KB

  • MD5

    e8aad678d9b78b481a69676f5a7fb660

  • SHA1

    077b4ada1bdb042ca367d616e30259fde90f3a71

  • SHA256

    154ebc6e51d30fc88bd92b19485cbabfaab3526b71ad36d78c40e4612943c03f

  • SHA512

    c64bab8575fe59e5b66f373b2e2a74e756547c0ccdfd1f3b5a77167e49581b93195f0821c0ef7836350e37f43c869fe087e477c37397910138cbfb32d04daf87

  • SSDEEP

    6144:zA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYQ:zATuTAnKGwUAWVycQqgj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2768
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3412
      • C:\Users\Admin\AppData\Local\Temp\154ebc6e51d30fc88bd92b19485cbabfaab3526b71ad36d78c40e4612943c03fN.exe
        "C:\Users\Admin\AppData\Local\Temp\154ebc6e51d30fc88bd92b19485cbabfaab3526b71ad36d78c40e4612943c03fN.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1864
        • C:\Windows\SysWOW64\winver.exe
          winver
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 300
            4⤵
            • Program crash
            PID:3048
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 816
          3⤵
          • Program crash
          PID:1188
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:1796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 956 -ip 956
      1⤵
        PID:812
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1864 -ip 1864
        1⤵
          PID:1668

        Network

        • flag-us
          DNS
          13.86.106.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          13.86.106.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          64.159.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          64.159.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          196.249.167.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          196.249.167.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          50.23.12.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          50.23.12.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          241.42.69.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          241.42.69.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.210.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.210.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          elitiorecfreetoo.cc
          154ebc6e51d30fc88bd92b19485cbabfaab3526b71ad36d78c40e4612943c03fN.exe
          Remote address:
          8.8.8.8:53
          Request
          elitiorecfreetoo.cc
          IN A
          Response
          elitiorecfreetoo.cc
          IN A
          216.218.185.162
        • flag-us
          DNS
          182.129.81.91.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          182.129.81.91.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          172.214.232.199.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          172.214.232.199.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          13.227.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          13.227.111.52.in-addr.arpa
          IN PTR
          Response
        No results found
        • 8.8.8.8:53
          13.86.106.20.in-addr.arpa
          dns
          71 B
          157 B
          1
          1

          DNS Request

          13.86.106.20.in-addr.arpa

        • 8.8.8.8:53
          64.159.190.20.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          64.159.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
          144 B
          1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          196.249.167.52.in-addr.arpa
          dns
          73 B
          147 B
          1
          1

          DNS Request

          196.249.167.52.in-addr.arpa

        • 8.8.8.8:53
          50.23.12.20.in-addr.arpa
          dns
          70 B
          156 B
          1
          1

          DNS Request

          50.23.12.20.in-addr.arpa

        • 8.8.8.8:53
          241.42.69.40.in-addr.arpa
          dns
          71 B
          145 B
          1
          1

          DNS Request

          241.42.69.40.in-addr.arpa

        • 8.8.8.8:53
          172.210.232.199.in-addr.arpa
          dns
          74 B
          128 B
          1
          1

          DNS Request

          172.210.232.199.in-addr.arpa

        • 8.8.8.8:53
          elitiorecfreetoo.cc
          dns
          154ebc6e51d30fc88bd92b19485cbabfaab3526b71ad36d78c40e4612943c03fN.exe
          65 B
          81 B
          1
          1

          DNS Request

          elitiorecfreetoo.cc

          DNS Response

          216.218.185.162

        • 8.8.8.8:53
          182.129.81.91.in-addr.arpa
          dns
          72 B
          147 B
          1
          1

          DNS Request

          182.129.81.91.in-addr.arpa

        • 8.8.8.8:53
          172.214.232.199.in-addr.arpa
          dns
          74 B
          128 B
          1
          1

          DNS Request

          172.214.232.199.in-addr.arpa

        • 8.8.8.8:53
          13.227.111.52.in-addr.arpa
          dns
          72 B
          158 B
          1
          1

          DNS Request

          13.227.111.52.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1864-9-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-3-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-1-0x0000000004640000-0x0000000004C98000-memory.dmp

          Filesize

          6.3MB

        • memory/1864-25-0x0000000004640000-0x0000000004C98000-memory.dmp

          Filesize

          6.3MB

        • memory/1864-5-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-6-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-7-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-8-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-22-0x0000000005B50000-0x0000000006550000-memory.dmp

          Filesize

          10.0MB

        • memory/1864-2-0x0000000002620000-0x0000000002621000-memory.dmp

          Filesize

          4KB

        • memory/1864-4-0x0000000004640000-0x0000000004C98000-memory.dmp

          Filesize

          6.3MB

        • memory/1864-13-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

        • memory/1864-17-0x0000000005B50000-0x0000000006550000-memory.dmp

          Filesize

          10.0MB

        • memory/2768-20-0x0000000000070000-0x0000000000076000-memory.dmp

          Filesize

          24KB

        • memory/2768-26-0x0000000000070000-0x0000000000076000-memory.dmp

          Filesize

          24KB

        • memory/3412-18-0x0000000000D70000-0x0000000000D76000-memory.dmp

          Filesize

          24KB

        • memory/3412-12-0x0000000000D60000-0x0000000000D66000-memory.dmp

          Filesize

          24KB

        • memory/3412-11-0x0000000000D60000-0x0000000000D66000-memory.dmp

          Filesize

          24KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.