Analysis
-
max time kernel
4294181s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
09-03-2022 05:40
Behavioral task
behavioral1
Sample
ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe
Resource
win7-20220223-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe
-
Size
711KB
-
MD5
00013a69b22a88dd166f3caf7c5350ec
-
SHA1
edde0d67542ac602917135e13c6f843f1c54af76
-
SHA256
ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f
-
SHA512
b2e62522da34e7f09e969620d85d9bcac1c1dae56d715312bff727659589a6817bddffdfe3784c7dcda7430d52bc05bb765136346ee45f9e1b50072c2c39b88f
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE" ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE" ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\CSRLT.EXE ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe File opened for modification C:\Windows\SysWOW64\CSRLT.EXE ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\MSBLT.EXE ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe File opened for modification C:\Windows\MSBLT.EXE ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe"C:\Users\Admin\AppData\Local\Temp\ab1a6d28b54fa5a83402f868aa2031fdebf68cdd6c0ad1bbdc3fc354225bfd7f.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:1516