63dd0a2a872fe7368088cd4916ed199f6ead9c5f5843facdcaa578bb68dedd57

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11/05/2022, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
15aab4c1603b00c7f820ce86decbdf03.exe
Size 1.1MB
Sample220511-mydntsbael
SHA256 63dd0a2a872fe7368088cd4916ed199f6ead9c5f5843facdcaa578bb68dedd57
MD5 15aab4c1603b00c7f820ce86decbdf03
SHA1 78f32cca891fb58e6f9445b28c9d2eda84c348d4
SHA512 3ace8389f79dc90cdc92aa1aab8315db5aecdec87fa9bc5da572cb69c9fe1b42a1665f3e09dfb4c31cdf752a0ddce392e916147eccecaaa49b634fed716907e4
MD5 SHA1 SHA512

Score

10^/10

persistence suricata

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2252 created 768	2252	Osato.exe.pif	39

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata
Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2252	Osato.exe.pif

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url	cmd.exe

Loads dropped DLL 6 IoCs

pid	Process
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	15aab4c1603b00c7f820ce86decbdf03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	15aab4c1603b00c7f820ce86decbdf03.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 1960	2252	Osato.exe.pif	103

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4444	tasklist.exe
1672	tasklist.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5052	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe
1960	jsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	1960	jsc.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2252	Osato.exe.pif
2252	Osato.exe.pif
2252	Osato.exe.pif

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2596	3504	15aab4c1603b00c7f820ce86decbdf03.exe	81
PID 3504 wrote to memory of 2596	3504	15aab4c1603b00c7f820ce86decbdf03.exe	81
PID 3504 wrote to memory of 2596	3504	15aab4c1603b00c7f820ce86decbdf03.exe	81
PID 3504 wrote to memory of 5040	3504	15aab4c1603b00c7f820ce86decbdf03.exe	83
PID 3504 wrote to memory of 5040	3504	15aab4c1603b00c7f820ce86decbdf03.exe	83
PID 3504 wrote to memory of 5040	3504	15aab4c1603b00c7f820ce86decbdf03.exe	83
PID 5040 wrote to memory of 4228	5040	cmd.exe	85
PID 5040 wrote to memory of 4228	5040	cmd.exe	85
PID 5040 wrote to memory of 4228	5040	cmd.exe	85
PID 4228 wrote to memory of 4444	4228	cmd.exe	86
PID 4228 wrote to memory of 4444	4228	cmd.exe	86
PID 4228 wrote to memory of 4444	4228	cmd.exe	86
PID 4228 wrote to memory of 4860	4228	cmd.exe	87
PID 4228 wrote to memory of 4860	4228	cmd.exe	87
PID 4228 wrote to memory of 4860	4228	cmd.exe	87
PID 4228 wrote to memory of 1672	4228	cmd.exe	88
PID 4228 wrote to memory of 1672	4228	cmd.exe	88
PID 4228 wrote to memory of 1672	4228	cmd.exe	88
PID 4228 wrote to memory of 2164	4228	cmd.exe	89
PID 4228 wrote to memory of 2164	4228	cmd.exe	89
PID 4228 wrote to memory of 2164	4228	cmd.exe	89
PID 4228 wrote to memory of 3584	4228	cmd.exe	90
PID 4228 wrote to memory of 3584	4228	cmd.exe	90
PID 4228 wrote to memory of 3584	4228	cmd.exe	90
PID 4228 wrote to memory of 2252	4228	cmd.exe	91
PID 4228 wrote to memory of 2252	4228	cmd.exe	91
PID 4228 wrote to memory of 2252	4228	cmd.exe	91
PID 4228 wrote to memory of 5052	4228	cmd.exe	92
PID 4228 wrote to memory of 5052	4228	cmd.exe	92
PID 4228 wrote to memory of 5052	4228	cmd.exe	92
PID 2252 wrote to memory of 5092	2252	Osato.exe.pif	93
PID 2252 wrote to memory of 5092	2252	Osato.exe.pif	93
PID 2252 wrote to memory of 5092	2252	Osato.exe.pif	93
PID 2252 wrote to memory of 1960	2252	Osato.exe.pif	103
PID 2252 wrote to memory of 1960	2252	Osato.exe.pif	103
PID 2252 wrote to memory of 1960	2252	Osato.exe.pif	103
PID 2252 wrote to memory of 1960	2252	Osato.exe.pif	103
PID 2252 wrote to memory of 1960	2252	Osato.exe.pif	103

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:768
- C:\Users\Admin\AppData\Local\Temp\15aab4c1603b00c7f820ce86decbdf03.exe
  "C:\Users\Admin\AppData\Local\Temp\15aab4c1603b00c7f820ce86decbdf03.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c 888
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c cmd < Portarono.mp3
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq BullGuardCore.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "bullguardcore.exe"
        5⤵
        
        PID:4860
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq PSUAService.exe"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /N "psuaservice.exe"
        5⤵
        
        PID:2164
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^DmvinaOCdClejMHFandvmKogUJYbrgYPRLGPBCYpmIJPZAlNAZqMUDlTdihOzsmwDxkBuRrQmuWRwzgznkWtgkVhANmzgpPioHjFgJGJVphOGaSXTTdoccMsnXqzaJBd$" Ore.mp3
        5⤵
        
        PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
        
        Osato.exe.pif V
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2252
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 5
        5⤵
        Runs ping.exe
        
        PID:5052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url" & echo URL="C:\Users\Admin\AppData\Local\Temp\cVLwyGVSJN\rTmuE.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cSxODqYTXd.url"
  2⤵
  - Drops startup file
  PID:5092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ore.mp3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ore.mp3
Size 924KB
SHA256 d4ea92beb311f37b9e2cd930f81815326eea3c100c41edf13f376cf6d1e11b00
MD5 2115938e7a71160340403be1b1340543
SHA1 dec557d6b9e866b1f358246e3ce4dee6826afbb9
SHA512 5c50242ee284dbf3b480efe9826f6956669baa2a5946f76cf0adf53287175ec118ea8aeef2fd138518614ce6ebd2f6c33f30649c61c998942c94ed88365f2883
SSDEEP 24576:jErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:j86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Osato.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Osato.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Osato.exe.pif
Size 924KB
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4
SSDEEP 24576:LErOxpVnqgt5ExLh27RQlf7Yfq2WZz2a1BB69:L86pqeE74aB0Sdia1W9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Portarono.mp3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Portarono.mp3
Size 10KB
SHA256 f37485ebd8cbdbd8d2ee4726d2ac7a7bf5ece89c2a6a73c4deb5b82c016e9754
MD5 82025c34b484302a4fff401c967a52a2
SHA1 2426a61b368d4d5b528b7f47bdb5d09988bacac0
SHA512 eb7c4c6283679fcbc5b39c2fb8eb35fd450696c04acf42ef75a17a8bfdf42c8c9055ae001e214d08b0ede329695ec04511e418238a1af5d2127d0eefa6968110
SSDEEP 192:z5MQkwAMsnGLAvFayXJ4nwBwb/NP+Q+34nlFNP+k86XQOqxx0:zqQynCA9AXVlIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uccelli.mp3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Uccelli.mp3
Size 1.5MB
SHA256 01f060e824f74dc7519e90caa1999918ad85a340cca66f158fd6250c356c3fed
MD5 8d834473dddd6c0389ebeb9b0a63a54e
SHA1 b2679dd0661e42578d6c5125d06cbfaca570bef6
SHA512 98116ad53b3e8445af796792d8feaa87d2c9d1a3238dd1b793542585127cac20ea8f413fb0420b58705d91d39b5e70bebcf950cbc854813b9e33d578a909d2d8
SSDEEP 24576:igPesbYHjF8zQdWM9Iq+owdS6Hx6djQPzPXFcgBRLA+mSecCM:igPesEEQKFcgBxecCM
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcMfGstCAjBOw.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bcMfGstCAjBOw.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcMfGstCAjBOw.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bcMfGstCAjBOw.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcMfGstCAjBOw.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bcMfGstCAjBOw.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcMfGstCAjBOw.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bcMfGstCAjBOw.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcMfGstCAjBOw.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bcMfGstCAjBOw.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcMfGstCAjBOw.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bcMfGstCAjBOw.dll
Size 1.6MB
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
SSDEEP 24576:qhYK3o0FvOh/e8AuDq8TJqbEPVVdqi90gvuPGO12HoIGTufqN8:2XFvO5egq8TMbEL59JCKSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1960-151-0x0000000000550000-0x00000000005E6000-memory.dmp

Download

memory/1960-155-0x0000000005810000-0x0000000005DB4000-memory.dmp

Download

memory/1960-158-0x00000000069B0000-0x0000000006A16000-memory.dmp

Download

memory/1960-157-0x0000000006760000-0x00000000067F2000-memory.dmp

Download

memory/1960-156-0x0000000005320000-0x0000000005370000-memory.dmp

Download