523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9

Analysis

max time kernel
178s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2022, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
Size 1.4MB
Sample220717-d9vxtaeed3
SHA256 523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9
MD5 7f0ac479ef241a90cc85b105cb450141
SHA1 4ba8d7dd21ec2cdb549e4d6081d50a6e4995bda3
SHA512 b480a860d9e9bfd5f6c8254e87f2dc9f64d01270ef6bd45c584435482b39375551d7ad5f3b61b8d94b2e2d9ba6c80f2097bd6521f468338e208782b0b17a3632
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://c.statcounter.com/9845037/0/5d76be22/1/
exe.dropper
http://shortit.icu/dseeda
exe.dropper
http://shortit.icu/fffdsfe

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
57	372	powershell.exe
59	372	powershell.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 880 set thread context of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
372	powershell.exe
372	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 880 wrote to memory of 1928	880	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	77
PID 1928 wrote to memory of 372	1928	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	78
PID 1928 wrote to memory of 372	1928	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	78
PID 1928 wrote to memory of 372	1928	523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe	78

C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
"C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe
  "C:\Users\Admin\AppData\Local\Temp\523804ecee3d914a348820d0a6794671c0ca6b7a829b996c56beaca5d10fb6c9.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -NonI -W Hidden -Exec Bypass "& '.\last.ps1'
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

last.ps1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\last.ps1
Size 1KB
SHA256 45fc6821f58cd252eb2c1371d238bc0a1abd9c8448f27970d8eaf374a3bcfc78
MD5 6833ae48a19cc215ae93b1e6478c855e
SHA1 72c8090dac80eeb34096563693b06d6d0d9ad0ec
SHA512 e7c57100323a031ba59444b25f76da1b6c30af16395d02f2718e0ea952443aa2e70f09e83e2c0e4c78b4038a30c848519329f1d9d64c540a7959a3f21f97af15
MD5 SHA1 SHA512

Submit Download

memory/372-141-0x00000000067D0000-0x00000000067EE000-memory.dmp

Download

memory/372-147-0x0000000008C50000-0x00000000091F4000-memory.dmp

Download

memory/372-146-0x0000000007BE0000-0x0000000007C02000-memory.dmp

Download

memory/372-145-0x0000000007C80000-0x0000000007D16000-memory.dmp

Download

memory/372-136-0x00000000018C0000-0x00000000018F6000-memory.dmp

Download

memory/372-137-0x00000000059B0000-0x0000000005FD8000-memory.dmp

Download

memory/372-138-0x00000000057E0000-0x0000000005802000-memory.dmp

Download

memory/372-144-0x0000000006CE0000-0x0000000006CFA000-memory.dmp

Download

memory/372-139-0x0000000005FE0000-0x0000000006046000-memory.dmp

Download

memory/372-140-0x0000000006140000-0x00000000061A6000-memory.dmp

Download

memory/372-143-0x0000000008020000-0x000000000869A000-memory.dmp

Download

memory/1928-131-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1928-132-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1928-135-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1928-133-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1928-148-0x0000000000400000-0x000000000043F000-memory.dmp

Download