98a835c2be0b56df2a4a165bb9f437f18edd844e90e0e3a9ef5a6140476ccd9c

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220331-en
submitted
14/04/2022, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe
Size 1.2MB
Sample220414-ml4pgsbab7
SHA256 98a835c2be0b56df2a4a165bb9f437f18edd844e90e0e3a9ef5a6140476ccd9c
MD5 fa8354e9715ed8e745403b6f8f163f50
SHA1 b2f9a493a5390006aae5a5c93da49c9b7ef27b3f
SHA512 8ecebd1f3fcd40458759127c0c0d10d0010968c2f86975959839c05b4725f5c10b4d111cff654e6f489f3eab11a8ac3f188ffdda964bcf91bd35e42f4da9d6b0
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
956	PsExec.exe
1740	PSEXESVC.exe
2000	Anti-Registration.exe

Loads dropped DLL 2 IoCs

pid	Process
788	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe
1740	PSEXESVC.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT	Anti-Registration.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT	Anti-Registration.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\PSEXESVC.exe	PsExec.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\GDIPlus	Anti-Registration.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\GDIPlus\FontCachePath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local"	Anti-Registration.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	Anti-Registration.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	1740	PSEXESVC.exe
Token: SeDebugPrivilege	2000	Anti-Registration.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 956	788	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	28
PID 788 wrote to memory of 956	788	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	28
PID 788 wrote to memory of 956	788	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	28
PID 788 wrote to memory of 956	788	SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe	28
PID 1740 wrote to memory of 2000	1740	PSEXESVC.exe	31
PID 1740 wrote to memory of 2000	1740	PSEXESVC.exe	31
PID 1740 wrote to memory of 2000	1740	PSEXESVC.exe	31
PID 1740 wrote to memory of 2000	1740	PSEXESVC.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop6.57674.13164.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788
- \??\c:\zbxcdc\PsExec.exe
  "c:\zbxcdc\PsExec.exe" -accepteula -i -s "c:\zbxcdc\Anti-Registration.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:956

C:\Windows\PSEXESVC.exe
C:\Windows\PSEXESVC.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- \??\c:\zbxcdc\Anti-Registration.exe
  "c:\zbxcdc\Anti-Registration.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

PSEXESVC.exe

Path C:\Windows\PSEXESVC.exe
Size 180KB
SHA256 714d90445775684f61e4589ca6868077a72f733b857b94c307397877a350b46a
MD5 5cb94f11459da45d647d888ef4438b5b
SHA1 eaf8c9fc443de5884ab38d00d30939f95df20732
SHA512 353ca268c33651f5c93663ba20c28ab67ac7a7c8754e51321b10f257230eeb5f578165e930ee4d9479a847421be990d9b2fe5cc8ce1c147bb6d63454e9f0882d
SSDEEP 3072:qhNW5RX1LNnszOYshCpas8IrJiywly+I75Qr2TKJUjnsA+2+CS:J5RX1LNnszICpD8Ixwly+Ic5LA+v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anti-Registration.exe

Path C:\zbxcdc\Anti-Registration.exe
Size 272KB
SHA256 32608bf9f26a3e5ec479d9985a55fde92133e6cd61ffdab034b01ed8e17977e7
MD5 8f5034b13695864b2e6f137ce7bc4f1e
SHA1 1505c9bc1325d29b3e31944ba376f8c71d6758dc
SHA512 62820aa124fe350ab96389c3d70adca9dde4e4a8c557049f24878dfe1a47b971c574ea1bde6663d1cc68d5796b766022e71c666ec528d1dabfe93e6bf128c3ae
SSDEEP 3072:Ph6g9m+prM72xwlb23IrsmMwAufKqiU+uBKKA1c0ScRaa:Ph6hF7xbqIrIwA12+ub
MD5 SHA1 SHA512 SSDEEP

Submit Download

PsExec.exe

Path C:\zbxcdc\PsExec.exe
Size 378KB
SHA256 3c26ef3208a8bf6c2a23d46ef15c238197f528c04877db0bac2a090d15ec53b2
MD5 d0df366711c8b296680002840336b6fd
SHA1 9a46e577206d306d9d2b2ab2f72689e4f5f38fb1
SHA512 ccf80a62af478a040dca9a6bbb6aa8253f7dc5bac84cb2191e0293b6bfa8b1c6b07460201033e280ee8b200a1df14a0eb84bccf6916342449bdbad1b67268cd8
SSDEEP 6144:uvZGdTNLQ2SKD7PRDZmTHd5RX1LNnszICpD8Ixwly+Ic5LA+6j:uBGdxNl3PRdeLNnskrEWq+w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Anti-Registration.exe

Path \??\c:\zbxcdc\Anti-Registration.exe
Size 272KB
SHA256 32608bf9f26a3e5ec479d9985a55fde92133e6cd61ffdab034b01ed8e17977e7
MD5 8f5034b13695864b2e6f137ce7bc4f1e
SHA1 1505c9bc1325d29b3e31944ba376f8c71d6758dc
SHA512 62820aa124fe350ab96389c3d70adca9dde4e4a8c557049f24878dfe1a47b971c574ea1bde6663d1cc68d5796b766022e71c666ec528d1dabfe93e6bf128c3ae
SSDEEP 3072:Ph6g9m+prM72xwlb23IrsmMwAufKqiU+uBKKA1c0ScRaa:Ph6hF7xbqIrIwA12+ub
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbxcdc.txt

Path \??\c:\zbxcdc\zbxcdc.txt
Size 16B
SHA256 7f479889d839d13ebb3853b12d503738a576a0a852589525138df0d26a21c39d
MD5 b0a4dd984c8b57c6809a951dc23ada51
SHA1 293ab85791e6ecb4277096cadc15426e2a409f00
SHA512 5d56db2a164ed2e69af82dc27212ead2ca26708d40c3bace6eaea80111a9d3c498085a6008544a053ec2b5c08c34ce4f5d7b97c76fa994be6fcfaeb4c571c2ba
MD5 SHA1 SHA512

Submit Download

Anti-Registration.exe

Path \zbxcdc\Anti-Registration.exe
Size 272KB
SHA256 32608bf9f26a3e5ec479d9985a55fde92133e6cd61ffdab034b01ed8e17977e7
MD5 8f5034b13695864b2e6f137ce7bc4f1e
SHA1 1505c9bc1325d29b3e31944ba376f8c71d6758dc
SHA512 62820aa124fe350ab96389c3d70adca9dde4e4a8c557049f24878dfe1a47b971c574ea1bde6663d1cc68d5796b766022e71c666ec528d1dabfe93e6bf128c3ae
SSDEEP 3072:Ph6g9m+prM72xwlb23IrsmMwAufKqiU+uBKKA1c0ScRaa:Ph6hF7xbqIrIwA12+ub
MD5 SHA1 SHA512 SSDEEP

Submit Download

PsExec.exe

Path \zbxcdc\PsExec.exe
Size 378KB
SHA256 3c26ef3208a8bf6c2a23d46ef15c238197f528c04877db0bac2a090d15ec53b2
MD5 d0df366711c8b296680002840336b6fd
SHA1 9a46e577206d306d9d2b2ab2f72689e4f5f38fb1
SHA512 ccf80a62af478a040dca9a6bbb6aa8253f7dc5bac84cb2191e0293b6bfa8b1c6b07460201033e280ee8b200a1df14a0eb84bccf6916342449bdbad1b67268cd8
SSDEEP 6144:uvZGdTNLQ2SKD7PRDZmTHd5RX1LNnszICpD8Ixwly+Ic5LA+6j:uBGdxNl3PRdeLNnskrEWq+w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-55-0x00000000743F0000-0x000000007499B000-memory.dmp

Download

memory/788-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Download

memory/2000-67-0x0000000001FE0000-0x0000000001FE2000-memory.dmp

Download

memory/2000-66-0x000007FEF2B10000-0x000007FEF3BA6000-memory.dmp

Download

memory/2000-69-0x0000000001FE6000-0x0000000002005000-memory.dmp

Download