34b5873621d4f24ea1ff0f45d19e4f0b448febc8a23997e1e52a6e4815d6af89

Resubmissions

27/07/2022, 06:36

220727-hdem6sbbfp8

24/08/2021, 06:28

210824-tvjedf7mnj8

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2022, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3021a46091be8b849034db6395dfc65.exe
Size 441KB
Sample220727-hdem6sbbfp
SHA256 34b5873621d4f24ea1ff0f45d19e4f0b448febc8a23997e1e52a6e4815d6af89
MD5 a3021a46091be8b849034db6395dfc65
SHA1 ee71f91939df0f375b522b7fefb300ea15492e8a
SHA512 ebe713848343a5a7715640217329c7f254e72f080b843732147e2eac455ac87e1ecee87bc6e24b8a16b52a8eccc90e090193af2f6351a3fa4d772535d4972249
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4848	33A2E4F0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	a3021a46091be8b849034db6395dfc65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe"	a3021a46091be8b849034db6395dfc65.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	a3021a46091be8b849034db6395dfc65.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe"	a3021a46091be8b849034db6395dfc65.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
212	3528	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4848	3528	a3021a46091be8b849034db6395dfc65.exe	81
PID 3528 wrote to memory of 4848	3528	a3021a46091be8b849034db6395dfc65.exe	81
PID 3528 wrote to memory of 4848	3528	a3021a46091be8b849034db6395dfc65.exe	81

C:\Users\Admin\AppData\Local\Temp\a3021a46091be8b849034db6395dfc65.exe
"C:\Users\Admin\AppData\Local\Temp\a3021a46091be8b849034db6395dfc65.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3528
- C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe
  "C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 608
  2⤵
  - Program crash
  PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3528 -ip 3528
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33A2E4F0.exe

Path C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe
Size 441KB
SHA256 34b5873621d4f24ea1ff0f45d19e4f0b448febc8a23997e1e52a6e4815d6af89
MD5 a3021a46091be8b849034db6395dfc65
SHA1 ee71f91939df0f375b522b7fefb300ea15492e8a
SHA512 ebe713848343a5a7715640217329c7f254e72f080b843732147e2eac455ac87e1ecee87bc6e24b8a16b52a8eccc90e090193af2f6351a3fa4d772535d4972249
SSDEEP 12288:1/3Nmt53TPU+MoHDlAvcgzB6QTOWYye0jTXryH0:853TBIKUne0vE
MD5 SHA1 SHA512 SSDEEP

Submit Download

33A2E4F0.exe

Path C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe
Size 441KB
SHA256 34b5873621d4f24ea1ff0f45d19e4f0b448febc8a23997e1e52a6e4815d6af89
MD5 a3021a46091be8b849034db6395dfc65
SHA1 ee71f91939df0f375b522b7fefb300ea15492e8a
SHA512 ebe713848343a5a7715640217329c7f254e72f080b843732147e2eac455ac87e1ecee87bc6e24b8a16b52a8eccc90e090193af2f6351a3fa4d772535d4972249
SSDEEP 12288:1/3Nmt53TPU+MoHDlAvcgzB6QTOWYye0jTXryH0:853TBIKUne0vE
MD5 SHA1 SHA512 SSDEEP

Submit Download

A56FE8E8E07249AFA0AC27

Path C:\Users\Admin\AppData\Local\Temp\A56FE8E8E07249AFA0AC27
Size 140B
SHA256 bb6bc648907744cee2ec47014d2c6effb989ee5ab8392d564e2663800f818d05
MD5 6c82697915cb3d7ab314ad562aa3c95b
SHA1 9ff02b093722468ae457c68d3ee85e4e83b5ebbf
SHA512 444b44cff22c1efa4c0994397e6b0c1a709a416d171cd8c8013bc8e1778c7e98b10d149cf08089ed0b7d1bd051f6d0a76b1dda1af6b3d30aedc166ca00258bc6
MD5 SHA1 SHA512

Submit Download

memory/3528-130-0x00000000026DD000-0x0000000002717000-memory.dmp

Download

memory/3528-131-0x00000000041B0000-0x0000000004200000-memory.dmp

Download

memory/3528-135-0x0000000000400000-0x00000000023D8000-memory.dmp

Download

memory/3528-137-0x00000000026DD000-0x0000000002717000-memory.dmp

Download

memory/4848-136-0x00000000024FC000-0x0000000002537000-memory.dmp

Download

memory/4848-138-0x0000000000400000-0x00000000023D8000-memory.dmp

Download

memory/4848-140-0x0000000000400000-0x00000000023D8000-memory.dmp

Download

memory/4848-141-0x00000000024FC000-0x0000000002537000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads