7c06629900f10564f1cad8b47f644dafad30e2df15d7ae2ca936dfd843a99993

Analysis

max time kernel
201s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c06629900f10564f1cad8b47f644dafad30e2df15d7ae2ca936dfd843a99993.exe
Size

152KB
MD5

6a61342aa2c55cb38b07894ecd3493e8
SHA1

b83e9ea313c56f053eedef88109b09d6d963d194
SHA256

7c06629900f10564f1cad8b47f644dafad30e2df15d7ae2ca936dfd843a99993
SHA512

0d42eee3e32472725ba26d2a0f01f343b0ad8d3eb80d1c11fb5db16d50f5b85da0ce1f2cf4beffa0ccdc650ca2d53a7db381ce8d3177754fb9b3ca7064b65668
SSDEEP

3072:pidj6ShhYRa3SXjF/HvD9hQU7OCyIjAYxRwmdPkmkWt+3t97SVKmHkAJbbk:pEjpvYc3YJ/HvD9hTKCyI7TwmdMlL997

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1540	znblaln.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\znblaln.exe	7c06629900f10564f1cad8b47f644dafad30e2df15d7ae2ca936dfd843a99993.exe
File created	C:\PROGRA~3\Mozilla\czmmuxc.dll	znblaln.exe

C:\Users\Admin\AppData\Local\Temp\7c06629900f10564f1cad8b47f644dafad30e2df15d7ae2ca936dfd843a99993.exe
"C:\Users\Admin\AppData\Local\Temp\7c06629900f10564f1cad8b47f644dafad30e2df15d7ae2ca936dfd843a99993.exe"
1⤵
- Drops file in Program Files directory
PID:2308

C:\PROGRA~3\Mozilla\znblaln.exe
C:\PROGRA~3\Mozilla\znblaln.exe -irlyaih
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\znblaln.exe

Filesize
152KB

MD5
c5dcf60b22d6e746057aa796cd8fd16d

SHA1
5f252330a318d8281f0c1f19f9937773bc7c0a83

SHA256
fff7817113c383bcc40a9c26312aad981dcc7061a929d983a422be435539dff1

SHA512
dda3fa3bfe7a61cdb6de3b51794f3577fb0d3bd1b92b6ab51234bd52ee5aa484f6b8f76a7f7da723abd2adc89c74913ad97c4cd3c3df8b18ac37eee764cf1996

Download Submit
C:\ProgramData\Mozilla\znblaln.exe

Filesize
152KB

MD5
c5dcf60b22d6e746057aa796cd8fd16d

SHA1
5f252330a318d8281f0c1f19f9937773bc7c0a83

SHA256
fff7817113c383bcc40a9c26312aad981dcc7061a929d983a422be435539dff1

SHA512
dda3fa3bfe7a61cdb6de3b51794f3577fb0d3bd1b92b6ab51234bd52ee5aa484f6b8f76a7f7da723abd2adc89c74913ad97c4cd3c3df8b18ac37eee764cf1996

Download Submit
memory/1540-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1540-141-0x0000000001010000-0x000000000106B000-memory.dmp

Filesize
364KB

Download
memory/2308-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2308-133-0x00000000025C0000-0x000000000261B000-memory.dmp

Filesize
364KB

Download