Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 05:16

General

  • Target

    Server.exe

  • Size

    93KB

  • MD5

    3f3ae3a450723c80b1aaff419e0d1369

  • SHA1

    bb3e89cde4dd9d29a688b25a0002163540555b6d

  • SHA256

    8d4c9b97cae0f3c35ab9a5ffa7f1ab45f7c304fb0d7c517828fed0c2048f6d4a

  • SHA512

    81cfe00bfb7ff567b66747937c37ee846ae8a672dd3be573b013bc431c2d7d9602f7c02f568a3c996cefc2f86ca9597bc64e9f615b3ef7aae45360e3d15f6aab

  • SSDEEP

    768:QY33lgSRmnldjcRoMwrx7Y+DIkIITJbXX0pOt8ux82SXxrjEtCdnl2pi1Rz4Rk33:PlTmlbrq+1NTZ0OMjEwzGi1dDzDXgS

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1136
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2368
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2364

Network

  • flag-us
    DNS
    6.tcp.eu.ngrok.io
    Server.exe
    Remote address:
    8.8.8.8:53
    Request
    6.tcp.eu.ngrok.io
    IN A
    Response
    6.tcp.eu.ngrok.io
    IN A
    3.68.171.119
  • flag-us
    DNS
    6.tcp.eu.ngrok.io
    Server.exe
    Remote address:
    8.8.8.8:53
    Request
    6.tcp.eu.ngrok.io
    IN A
    Response
    6.tcp.eu.ngrok.io
    IN A
    18.197.239.109
  • flag-us
    DNS
    6.tcp.eu.ngrok.io
    Server.exe
    Remote address:
    8.8.8.8:53
    Request
    6.tcp.eu.ngrok.io
    IN A
    Response
    6.tcp.eu.ngrok.io
    IN A
    3.68.171.119
  • flag-us
    DNS
    6.tcp.eu.ngrok.io
    Server.exe
    Remote address:
    8.8.8.8:53
    Request
    6.tcp.eu.ngrok.io
    IN A
    Response
    6.tcp.eu.ngrok.io
    IN A
    52.28.247.255
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    80 B
    3
    2
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 18.197.239.109:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 3.68.171.119:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    152 B
    120 B
    3
    3
  • 52.28.247.255:11237
    6.tcp.eu.ngrok.io
    Server.exe
    52 B
    40 B
    1
    1
  • 8.8.8.8:53
    6.tcp.eu.ngrok.io
    dns
    Server.exe
    63 B
    79 B
    1
    1

    DNS Request

    6.tcp.eu.ngrok.io

    DNS Response

    3.68.171.119

  • 8.8.8.8:53
    6.tcp.eu.ngrok.io
    dns
    Server.exe
    63 B
    79 B
    1
    1

    DNS Request

    6.tcp.eu.ngrok.io

    DNS Response

    18.197.239.109

  • 8.8.8.8:53
    6.tcp.eu.ngrok.io
    dns
    Server.exe
    63 B
    79 B
    1
    1

    DNS Request

    6.tcp.eu.ngrok.io

    DNS Response

    3.68.171.119

  • 8.8.8.8:53
    6.tcp.eu.ngrok.io
    dns
    Server.exe
    63 B
    79 B
    1
    1

    DNS Request

    6.tcp.eu.ngrok.io

    DNS Response

    52.28.247.255

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3052-2-0x0000000074DE0000-0x000000007538B000-memory.dmp

    Filesize

    5.7MB

  • memory/3052-1-0x0000000074DE0000-0x000000007538B000-memory.dmp

    Filesize

    5.7MB

  • memory/3052-0-0x0000000074DE1000-0x0000000074DE2000-memory.dmp

    Filesize

    4KB

  • memory/3052-4-0x0000000074DE0000-0x000000007538B000-memory.dmp

    Filesize

    5.7MB

  • memory/3052-5-0x0000000074DE0000-0x000000007538B000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.