2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba

Analysis

max time kernel
175s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe
Size

442KB
MD5

b2e7df4d0ef5fbf1899aef9f4bbc611b
SHA1

0ea873d64edb4fbd7ca7b727badbab822ed65927
SHA256

2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba
SHA512

29929cb015ad1559fe6f2b170e00b4a7785ef6b6e2a02e156938ce6be2672ec85a49457ee986423054d8ea6f85e47cf303cf7a3ca0472475d144c9cd66d1cdfa
SSDEEP

12288:IuMhtTX4rUQoM2Dik1WaWDhZH6AeoKXTG6w:rLrssa6ZHXgj

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4928	iLiIcPc09200.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4956-132-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4928-137-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4956-139-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4928-141-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4956-143-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\iLiIcPc09200 = "C:\\ProgramData\\iLiIcPc09200\\iLiIcPc09200.exe"	iLiIcPc09200.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe
Token: SeDebugPrivilege	4928	iLiIcPc09200.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4928	iLiIcPc09200.exe
4928	iLiIcPc09200.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4928	iLiIcPc09200.exe
4928	iLiIcPc09200.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	iLiIcPc09200.exe
4928	iLiIcPc09200.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4928	4956	2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe	79
PID 4956 wrote to memory of 4928	4956	2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe	79
PID 4956 wrote to memory of 4928	4956	2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe	79

C:\Users\Admin\AppData\Local\Temp\2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe
"C:\Users\Admin\AppData\Local\Temp\2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\ProgramData\iLiIcPc09200\iLiIcPc09200.exe
  "C:\ProgramData\iLiIcPc09200\iLiIcPc09200.exe" "C:\Users\Admin\AppData\Local\Temp\2d16373ab6c308d25ec16e33990b21024f9afed8b4e54b1c9551229afa1ca3ba.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\iLiIcPc09200\iLiIcPc09200.exe

Filesize
442KB

MD5
fe8d8713d4dd42d655fa59c2888c4c2f

SHA1
6c60a45fff79a9550e3d231f2311408488abddca

SHA256
325a9e165c863a7f1085f02f2e011b646643de42a118eb4599b563cb36441bec

SHA512
ef0c2f70eda695c25b35725212e84ca06c1fe1eae4d2d3bc3b26a7a510f69c7583048d0cb1147ccc323cc7a64d7448b0380e80a29643552f4fcc61754fc34bec

Download Submit
C:\ProgramData\iLiIcPc09200\iLiIcPc09200.exe

Filesize
442KB

MD5
fe8d8713d4dd42d655fa59c2888c4c2f

SHA1
6c60a45fff79a9550e3d231f2311408488abddca

SHA256
325a9e165c863a7f1085f02f2e011b646643de42a118eb4599b563cb36441bec

SHA512
ef0c2f70eda695c25b35725212e84ca06c1fe1eae4d2d3bc3b26a7a510f69c7583048d0cb1147ccc323cc7a64d7448b0380e80a29643552f4fcc61754fc34bec

Download Submit
memory/4928-138-0x000000000069A000-0x00000000006DA000-memory.dmp

Filesize
256KB

Download
memory/4928-137-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4928-141-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4928-142-0x000000000069A000-0x00000000006DA000-memory.dmp

Filesize
256KB

Download
memory/4956-133-0x00000000005EB000-0x000000000062B000-memory.dmp

Filesize
256KB

Download
memory/4956-132-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4956-139-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4956-140-0x00000000005EB000-0x000000000062B000-memory.dmp

Filesize
256KB

Download
memory/4956-143-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4956-144-0x00000000005EB000-0x000000000062B000-memory.dmp

Filesize
256KB

Download