d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382

Analysis

max time kernel
113s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe
Size

1.3MB
MD5

207f10035023a63e6fef9cb158c47a89
SHA1

790e2c116f13c5df65dfcba55a0df3319ea20f3b
SHA256

d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382
SHA512

2a16a9d1de53f19ef24e574195d48039a54b88a2a936f17daf802676ee6418f17a54b095d9899070e0f086bfbd2f81646b89f8e416d04e82d7f7ff8d92888171
SSDEEP

24576:0L/on4V2isII7sM88xkE8lV4SRyKbn6WQhDWuNlHXvV:oo4lPksM8OO4RKn6hnT

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
376	UNDC2E~1.EXE
1852	WR_37_~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
376	UNDC2E~1.EXE
1852	WR_37_~1.EXE
1852	WR_37_~1.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 376	448	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe	81
PID 448 wrote to memory of 376	448	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe	81
PID 448 wrote to memory of 376	448	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe	81
PID 448 wrote to memory of 1852	448	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe	89
PID 448 wrote to memory of 1852	448	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe	89
PID 448 wrote to memory of 1852	448	d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe	89

C:\Users\Admin\AppData\Local\Temp\d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe
"C:\Users\Admin\AppData\Local\Temp\d4626a4b40191b8c523d9194bebea80da5266861dc37c7877da67ef9d9aa0382.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNDC2E~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNDC2E~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WR_37_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WR_37_~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNDC2E~1.EXE

Filesize
20KB

MD5
6f361f69a986193d007ba75d47a7d3fc

SHA1
9646f1a60bbf3bc6546cbb9a2605d407d6608dd9

SHA256
682456975ed5b1fe08bbed8373afd4825114cd33e1447e0af14bd4ca8ddd95f2

SHA512
90f0b52caedc4622668f47de812aa10a12160dc4ee4d5bc65e051c3cabf10f65ba29f59570857b0ce94097a0f6f5707b2fb628f5a846991be8fd997afb502dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNDC2E~1.EXE

Filesize
20KB

MD5
6f361f69a986193d007ba75d47a7d3fc

SHA1
9646f1a60bbf3bc6546cbb9a2605d407d6608dd9

SHA256
682456975ed5b1fe08bbed8373afd4825114cd33e1447e0af14bd4ca8ddd95f2

SHA512
90f0b52caedc4622668f47de812aa10a12160dc4ee4d5bc65e051c3cabf10f65ba29f59570857b0ce94097a0f6f5707b2fb628f5a846991be8fd997afb502dad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WR_37_~1.EXE

Filesize
1.3MB

MD5
f70c1b3a8219e59a853c9cd1b6147877

SHA1
3ee873ee1cfedaaf55019ea03048b54319f5b260

SHA256
3d3b2e16829ff30e9ff5f3151a52a22849a1c5875439c2a0d570bc728af428ef

SHA512
7b825a08952fce7e0fea5269b9ee6c3d197730c2939540784debd189bc90667c645bbdcd473f6bb8cb0f478d9ce15f471124d4549e124e1083ede6f09c8c5a86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WR_37_~1.EXE

Filesize
1.3MB

MD5
f70c1b3a8219e59a853c9cd1b6147877

SHA1
3ee873ee1cfedaaf55019ea03048b54319f5b260

SHA256
3d3b2e16829ff30e9ff5f3151a52a22849a1c5875439c2a0d570bc728af428ef

SHA512
7b825a08952fce7e0fea5269b9ee6c3d197730c2939540784debd189bc90667c645bbdcd473f6bb8cb0f478d9ce15f471124d4549e124e1083ede6f09c8c5a86

Download Submit