efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe
Size

31KB
MD5

30707c1fbc733df7722c83a1c6409ddc
SHA1

b96e5554d7e19afc54180dc39b290126c2692247
SHA256

efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8
SHA512

3a5ea4e5cacb467ab14d7ebcdde6c3127e5c967df62045f8b1658330539a20b0daa87d5a235158a82086b74b9fd57dc498d540b3eca50e25f1504bdd9652dcec
SSDEEP

384:Y8itbjoQSa4zAxBGZTgAxt0W3kVptJu8Nq5gQp2s+JF51TfUzALeBxvRJ4Iv/PT3:Y85k5zGZTg9Ul0qZos+VcALAvzvz3

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ddcYoLCv.dll	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe
File created	C:\Windows\SysWOW64\ddcYoLCv.dll	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe
2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 604	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	5
PID 2736 wrote to memory of 1912	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	86
PID 2736 wrote to memory of 1912	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	86
PID 2736 wrote to memory of 1912	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	86
PID 2736 wrote to memory of 2768	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	87
PID 2736 wrote to memory of 2768	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	87
PID 2736 wrote to memory of 2768	2736	efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe	87

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Users\Admin\AppData\Local\Temp\efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe
"C:\Users\Admin\AppData\Local\Temp\efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe ,a
  2⤵
  PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\efff2a8c9748134d456f59556bb9ba5ffaf2ff2d122c6d68e67db19aa1098ab8.exe"
  2⤵
  PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\removalfile.bat

Filesize
43B

MD5
9a7ef09167a6f4433681b94351509043

SHA1
259b1375ed8e84943ca1d42646bb416325c89e12

SHA256
d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7

SHA512
96b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df

Download Submit
C:\Windows\SysWOW64\ddcYoLCv.dll

Filesize
24KB

MD5
e36bd16769c203580a085d672fd3df67

SHA1
015661aae971dd4f6cd2fe46cf4b4053807d22bc

SHA256
406070859fd01f1a4ce30a3daa7bc1801042ae09ece10c81a719f10c8d80feff

SHA512
45f5f1a751aed196644035e0ca1e38ab5caca33f2f1146e211fe372da98b49d0950e566135c703cff2d916e2095687a7e37d8b0a82422d84570695e5818e4953

Download Submit
memory/2736-138-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2736-136-0x0000000000490000-0x0000000000495000-memory.dmp

Filesize
20KB

Download
memory/2736-137-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2736-132-0x0000000000401000-0x000000000040E000-memory.dmp

Filesize
52KB

Download
memory/2736-139-0x0000000010001000-0x0000000010010000-memory.dmp

Filesize
60KB

Download
memory/2736-144-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2736-146-0x0000000000490000-0x0000000000495000-memory.dmp

Filesize
20KB

Download
memory/2736-145-0x0000000000490000-0x0000000000497000-memory.dmp

Filesize
28KB

Download
memory/2736-135-0x0000000000490000-0x0000000000497000-memory.dmp

Filesize
28KB

Download
memory/2736-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download