390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891

Resubmissions

13-03-2023 15:08

230313-sjcqwada2v 10

19-04-2022 02:37

220419-c4a5sabhb8 7

Analysis

max time kernel
116s
max time network
119s
platform
windows7_x64
resource
win7-20220414-en
submitted
19-04-2022 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe
Size

657KB
MD5

0d0823d9a5d000b80e27090754f59ee5
SHA1

b1f495b707ffaf53188c13f19a487dd94e7a0735
SHA256

390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891
SHA512

52a4ae72e2685a6b6d274388b636fe63d96e5545475e521e9e250d56d4593657061502f00c6b90f5e54d05a63a9301509852804b9d705307c03f8fff739d3964

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1848 cmd.exe

pid	process
1848	cmd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe

description	pid	process	target process
PID 756 wrote to memory of 1848	756	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe	cmd.exe
PID 756 wrote to memory of 1848	756	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe	cmd.exe
PID 756 wrote to memory of 1848	756	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe	cmd.exe
PID 756 wrote to memory of 1848	756	390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe
"C:\Users\Admin\AppData\Local\Temp\390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891.exe"
2⤵
- Deletes itself
PID:1848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x0000000075941000-0x0000000075943000-memory.dmp

Filesize
8KB

Download
memory/756-56-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/756-55-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/1848-57-0x0000000000000000-mapping.dmp

Download