63dd0a2a872fe7368088cd4916ed199f6ead9c5f5843facdcaa578bb68dedd57

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
11/05/2022, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15aab4c1603b00c7f820ce86decbdf03.exe
Size 1.1MB
Sample220511-mydntsbael
SHA256 63dd0a2a872fe7368088cd4916ed199f6ead9c5f5843facdcaa578bb68dedd57
MD5 15aab4c1603b00c7f820ce86decbdf03
SHA1 78f32cca891fb58e6f9445b28c9d2eda84c348d4
SHA512 3ace8389f79dc90cdc92aa1aab8315db5aecdec87fa9bc5da572cb69c9fe1b42a1665f3e09dfb4c31cdf752a0ddce392e916147eccecaaa49b634fed716907e4
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 564 created 1204	564	Osato.exe.pif	13

Executes dropped EXE 1 IoCs

pid	Process
564	Osato.exe.pif

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1796	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	15aab4c1603b00c7f820ce86decbdf03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	15aab4c1603b00c7f820ce86decbdf03.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1732	tasklist.exe
812	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
316	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
564	Osato.exe.pif
564	Osato.exe.pif
564	Osato.exe.pif
564	Osato.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	tasklist.exe
Token: SeDebugPrivilege	812	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
564	Osato.exe.pif
564	Osato.exe.pif
564	Osato.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
564	Osato.exe.pif
564	Osato.exe.pif
564	Osato.exe.pif

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1724	948	15aab4c1603b00c7f820ce86decbdf03.exe	26
PID 948 wrote to memory of 1724	948	15aab4c1603b00c7f820ce86decbdf03.exe	26
PID 948 wrote to memory of 1724	948	15aab4c1603b00c7f820ce86decbdf03.exe	26
PID 948 wrote to memory of 1724	948	15aab4c1603b00c7f820ce86decbdf03.exe	26
PID 948 wrote to memory of 840	948	15aab4c1603b00c7f820ce86decbdf03.exe	28
PID 948 wrote to memory of 840	948	15aab4c1603b00c7f820ce86decbdf03.exe	28
PID 948 wrote to memory of 840	948	15aab4c1603b00c7f820ce86decbdf03.exe	28
PID 948 wrote to memory of 840	948	15aab4c1603b00c7f820ce86decbdf03.exe	28
PID 840 wrote to memory of 1796	840	cmd.exe	30
PID 840 wrote to memory of 1796	840	cmd.exe	30
PID 840 wrote to memory of 1796	840	cmd.exe	30
PID 840 wrote to memory of 1796	840	cmd.exe	30
PID 1796 wrote to memory of 1732	1796	cmd.exe	31
PID 1796 wrote to memory of 1732	1796	cmd.exe	31
PID 1796 wrote to memory of 1732	1796	cmd.exe	31
PID 1796 wrote to memory of 1732	1796	cmd.exe	31
PID 1796 wrote to memory of 1028	1796	cmd.exe	32
PID 1796 wrote to memory of 1028	1796	cmd.exe	32
PID 1796 wrote to memory of 1028	1796	cmd.exe	32
PID 1796 wrote to memory of 1028	1796	cmd.exe	32
PID 1796 wrote to memory of 812	1796	cmd.exe	34
PID 1796 wrote to memory of 812	1796	cmd.exe	34
PID 1796 wrote to memory of 812	1796	cmd.exe	34
PID 1796 wrote to memory of 812	1796	cmd.exe	34
PID 1796 wrote to memory of 1768	1796	cmd.exe	35
PID 1796 wrote to memory of 1768	1796	cmd.exe	35
PID 1796 wrote to memory of 1768	1796	cmd.exe	35
PID 1796 wrote to memory of 1768	1796	cmd.exe	35
PID 1796 wrote to memory of 428	1796	cmd.exe	36
PID 1796 wrote to memory of 428	1796	cmd.exe	36
PID 1796 wrote to memory of 428	1796	cmd.exe	36
PID 1796 wrote to memory of 428	1796	cmd.exe	36
PID 1796 wrote to memory of 564	1796	cmd.exe	37
PID 1796 wrote to memory of 564	1796	cmd.exe	37
PID 1796 wrote to memory of 564	1796	cmd.exe	37
PID 1796 wrote to memory of 564	1796	cmd.exe	37
PID 1796 wrote to memory of 316	1796	cmd.exe	38
PID 1796 wrote to memory of 316	1796	cmd.exe	38
PID 1796 wrote to memory of 316	1796	cmd.exe	38
PID 1796 wrote to memory of 316	1796	cmd.exe	38
PID 564 wrote to memory of 1792	564	Osato.exe.pif	39
PID 564 wrote to memory of 1792	564	Osato.exe.pif	39
PID 564 wrote to memory of 1792	564	Osato.exe.pif	39
PID 564 wrote to memory of 1792	564	Osato.exe.pif	39

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\15aab4c1603b00c7f820ce86decbdf03.exe
  "C:\Users\Admin\AppData\Local\Temp\15aab4c1603b00c7f820ce86decbdf03.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c 888
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cmd < Portarono.mp3
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq BullGuardCore.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "bullguardcore.exe"
        5⤵
        
        PID:1028
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq PSUAService.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:812
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "psuaservice.exe"
        5⤵
        
        PID:1768
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^DmvinaOCdClejMHFandvmKogUJYbrgYPRLGPBCYpmIJPZAlNAZqMUDlTdihOzsmwDxkBuRrQmuWRwzgznkWtgkVhANmzgpPioHjFgJGJVphOGaSXTTdoccMsnXqzaJBd$" Ore.mp3
        5⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
        
        Osato.exe.pif V
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:564
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 5
        5⤵
        Runs ping.exe
        
        PID:316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url" & echo URL="C:\Users\Admin\AppData\Local\Temp\cVLwyGVSJN\rTmuE.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url"
  2⤵
  - Drops startup file
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ore.mp3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ore.mp3
Size 924KB
SHA256 d4ea92beb311f37b9e2cd930f81815326eea3c100c41edf13f376cf6d1e11b00
MD5 2115938e7a71160340403be1b1340543
SHA1 dec557d6b9e866b1f358246e3ce4dee6826afbb9
SHA512 5c50242ee284dbf3b480efe9826f6956669baa2a5946f76cf0adf53287175ec118ea8aeef2fd138518614ce6ebd2f6c33f30649c61c998942c94ed88365f2883
SSDEEP 24576:jErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:j86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Osato.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Osato.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portarono.mp3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Portarono.mp3
Size 10KB
SHA256 f37485ebd8cbdbd8d2ee4726d2ac7a7bf5ece89c2a6a73c4deb5b82c016e9754
MD5 82025c34b484302a4fff401c967a52a2
SHA1 2426a61b368d4d5b528b7f47bdb5d09988bacac0
SHA512 eb7c4c6283679fcbc5b39c2fb8eb35fd450696c04acf42ef75a17a8bfdf42c8c9055ae001e214d08b0ede329695ec04511e418238a1af5d2127d0eefa6968110
SSDEEP 192:z5MQkwAMsnGLAvFayXJ4nwBwb/NP+Q+34nlFNP+k86XQOqxx0:zqQynCA9AXVlIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uccelli.mp3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uccelli.mp3
Size 1.5MB
SHA256 01f060e824f74dc7519e90caa1999918ad85a340cca66f158fd6250c356c3fed
MD5 8d834473dddd6c0389ebeb9b0a63a54e
SHA1 b2679dd0661e42578d6c5125d06cbfaca570bef6
SHA512 98116ad53b3e8445af796792d8feaa87d2c9d1a3238dd1b793542585127cac20ea8f413fb0420b58705d91d39b5e70bebcf950cbc854813b9e33d578a909d2d8
SSDEEP 24576:igPesbYHjF8zQdWM9Iq+owdS6Hx6djQPzPXFcgBRLA+mSecCM:igPesEEQKFcgBxecCM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Osato.exe.pif

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/564-69-0x0000000074F21000-0x0000000074F23000-memory.dmp

Download