233a0b3629d257caeecf2fefb6597d8df5876967c292a706ddece460518537d5

Analysis

max time kernel
94s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

233a0b3629d257caeecf2fefb6597d8df5876967c292a706ddece460518537d5.exe
Size

438KB
MD5

652177eff39ae98eefc28205b493d500
SHA1

1a628cee3e82f52e0958bb5780858c243d285244
SHA256

233a0b3629d257caeecf2fefb6597d8df5876967c292a706ddece460518537d5
SHA512

166e49efdb13620761f9be8c36154f17a2ef1e17f3195f8d0a695f6d7f1ddfeff57d30eece8ff304bf57f7ba0d1bb1cf5b978d78a8a5ca6648a5cdf0a337bc87
SSDEEP

12288:51i/ljo6d94Z2NC+H07HQP4pgIHy0/GqBcL4DGsxv3FA+:51i9Igs57HQPzIXGqy0K2tn

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	nkvxlye.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nkvxlye.exe	233a0b3629d257caeecf2fefb6597d8df5876967c292a706ddece460518537d5.exe
File created	C:\PROGRA~3\Mozilla\mmpvyam.dll	nkvxlye.exe

C:\Users\Admin\AppData\Local\Temp\233a0b3629d257caeecf2fefb6597d8df5876967c292a706ddece460518537d5.exe
"C:\Users\Admin\AppData\Local\Temp\233a0b3629d257caeecf2fefb6597d8df5876967c292a706ddece460518537d5.exe"
1⤵
- Drops file in Program Files directory
PID:5016

C:\PROGRA~3\Mozilla\nkvxlye.exe
C:\PROGRA~3\Mozilla\nkvxlye.exe -xqialii
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nkvxlye.exe

Filesize
438KB

MD5
cb2465e7860beeb74e2377b396a2165e

SHA1
0ecd35ff3f2a92a6ace9d4ccd1be5f680693c22c

SHA256
c0f6781253af7cdd1ad57c07cc3f22f2a3ef5ccbff7d0dfe7db48d71797627af

SHA512
eeaff80f77b2ea55c6710db992776332a34cc9ed06ef302028253a53faab2932657556dc2c4b6b0e5c7c1ba53e74e9c802bee2125df98fcb4333ac55d69bb6c0

Download Submit
C:\ProgramData\Mozilla\nkvxlye.exe

Filesize
438KB

MD5
cb2465e7860beeb74e2377b396a2165e

SHA1
0ecd35ff3f2a92a6ace9d4ccd1be5f680693c22c

SHA256
c0f6781253af7cdd1ad57c07cc3f22f2a3ef5ccbff7d0dfe7db48d71797627af

SHA512
eeaff80f77b2ea55c6710db992776332a34cc9ed06ef302028253a53faab2932657556dc2c4b6b0e5c7c1ba53e74e9c802bee2125df98fcb4333ac55d69bb6c0

Download Submit
memory/2732-138-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2732-139-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/5016-132-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/5016-133-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download