d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66

Analysis

max time kernel
98s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe
Size

22KB
MD5

7751b1c2f100e3dba110a478c68aae45
SHA1

efeadd48b2a560f7de7fc8a09e3e2d80f5679e35
SHA256

d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66
SHA512

ebbca739011b85519389dc99cb123a7b1c0827bf99a2a7fae330cc21a95b676f7c2f8078a60e79d011594e3ea841bc28e2148b38840ed280acea3de247596cbd
SSDEEP

384:RbOk3d4UFcmFv4E5QGz6z7DZ1xYZRqlt/t244gbEl0jf74u/zbHKa555io19IKLd:gKVDQeQdVYW12FCSiHKa555WKucN

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\trqqxw47.sys	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe
File opened for modification	C:\Windows\SysWOW64\drivers\trqqxw47.sys	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\trqqxw47\ImagePath = "system32\\\\drivers\\\\trqqxw47.sys"	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe

Loads dropped DLL 1 IoCs

pid	Process
4112	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rsskplm = "rundll32.exe C:\\Windows\\system32\\trqqxw47.dll,Start"	rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\trqqxw47.dll	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe
File opened for modification	C:\Windows\SysWOW64\trqqxw47.dll	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe
File opened for modification	C:\Windows\SysWOW64\trqqxw47.dllmmc.pkm	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\DVL	rundll32.exe
File created	C:\Windows\fn00321.log	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4112	1104	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe	86
PID 1104 wrote to memory of 4112	1104	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe	86
PID 1104 wrote to memory of 4112	1104	d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe	86

C:\Users\Admin\AppData\Local\Temp\d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe
"C:\Users\Admin\AppData\Local\Temp\d0093a70d283a10f292de4f68b64a34f5e3b1129c0af0bb4fdcc7d2b2891ea66.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 C:\Windows\system32\trqqxw47.dll Start
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\trqqxw47.dll

Filesize
14KB

MD5
9b06bb966fc6ba1f4a3677f05f5c8997

SHA1
446532d272810c92878c00049eb9c484f57f9619

SHA256
2789aa5452060d01afae7fac905d7be27fb53e0f749a0269f67db489f196a23e

SHA512
287ed50056f67d24eba4ee1341802ab9d93bdb698c1ccff5a254673e74bf387bf90e06a93423f526eaf5bd61adfc2b5f854662458757df73ff4e800fd54531c7

Download Submit
C:\Windows\SysWOW64\trqqxw47.dll

Filesize
14KB

MD5
9b06bb966fc6ba1f4a3677f05f5c8997

SHA1
446532d272810c92878c00049eb9c484f57f9619

SHA256
2789aa5452060d01afae7fac905d7be27fb53e0f749a0269f67db489f196a23e

SHA512
287ed50056f67d24eba4ee1341802ab9d93bdb698c1ccff5a254673e74bf387bf90e06a93423f526eaf5bd61adfc2b5f854662458757df73ff4e800fd54531c7

Download Submit
memory/1104-135-0x0000000000400000-0x0000000000405870-memory.dmp

Filesize
22KB

Download
memory/1104-136-0x0000000000400000-0x0000000000405870-memory.dmp

Filesize
22KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads