Analysis
-
max time kernel
124s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 22:20
Behavioral task
behavioral1
Sample
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe
Resource
win10v2004-20220721-en
General
-
Target
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe
-
Size
1.5MB
-
MD5
92368dad3e64adca4dd3dd41f965fd30
-
SHA1
426cd319f3843893bb0eae7e5850d56bf34b33c1
-
SHA256
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430
-
SHA512
354e8e1e4c75322243ee09ef8f0ade34a68f166dc180952f6886dfa8c16e79d918d0cf9765993badbdfe026f93bfa3f8ea706f38ae0a7431b76dfdc6d2a13223
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1312-56-0x0000000000400000-0x0000000000715000-memory.dmp themida behavioral1/memory/1748-60-0x0000000000400000-0x0000000000715000-memory.dmp themida behavioral1/memory/1312-61-0x0000000000400000-0x0000000000715000-memory.dmp themida behavioral1/memory/1312-62-0x0000000000400000-0x0000000000715000-memory.dmp themida behavioral1/memory/1312-63-0x0000000000400000-0x0000000000715000-memory.dmp themida \??\c:\ProgramData\LrujuqV\YqtlhqJ\CkuoscQ.exe themida behavioral1/memory/1312-66-0x0000000000400000-0x0000000000715000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
notepad.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\CkuoscQ = "c:\\ProgramData\\LrujuqV\\YqtlhqJ\\CkuoscQ.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exedescription pid process target process PID 1748 set thread context of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exenotepad.exepid process 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe 1312 notepad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exedescription pid process target process PID 1748 wrote to memory of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe PID 1748 wrote to memory of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe PID 1748 wrote to memory of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe PID 1748 wrote to memory of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe PID 1748 wrote to memory of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe PID 1748 wrote to memory of 1312 1748 5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe"C:\Users\Admin\AppData\Local\Temp\5dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\ProgramData\LrujuqV\YqtlhqJ\CkuoscQ.exeFilesize
1.5MB
MD592368dad3e64adca4dd3dd41f965fd30
SHA1426cd319f3843893bb0eae7e5850d56bf34b33c1
SHA2565dcc6851244d6c8a78266dffe0fe7a609282105fd1c6c31cc0304a745a8bd430
SHA512354e8e1e4c75322243ee09ef8f0ade34a68f166dc180952f6886dfa8c16e79d918d0cf9765993badbdfe026f93bfa3f8ea706f38ae0a7431b76dfdc6d2a13223
-
memory/1312-54-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB
-
memory/1312-56-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB
-
memory/1312-57-0x00000000004BB014-mapping.dmp
-
memory/1312-61-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB
-
memory/1312-62-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB
-
memory/1312-63-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB
-
memory/1312-64-0x0000000000401000-0x0000000000450000-memory.dmpFilesize
316KB
-
memory/1312-66-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB
-
memory/1748-59-0x0000000000300000-0x00000000003E9000-memory.dmpFilesize
932KB
-
memory/1748-60-0x0000000000400000-0x0000000000715000-memory.dmpFilesize
3.1MB