f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8

Analysis

max time kernel
152s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe
Size

292KB
MD5

6ce3f7b1c5528e0e35d41dfb183e55b0
SHA1

3abd986acbd9d24b1a34140429873cc5e7504eea
SHA256

f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8
SHA512

9cddf430269eff3411c4083911151a2810c3f91e66f7f99c0012674faa6d4896709b30fd45f7997bfb45c72aa920f76051f15146f02a2b923c788535469b3e36
SSDEEP

6144:LMe2+6SvBCMyfay1pfdf3H0VHVIF11iBZJuY:LMH+Ef5DfXg1KJY

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1532	edac.exe

Deletes itself 1 IoCs

pid	Process
1588	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe
340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	edac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Edac = "C:\\Users\\Admin\\AppData\\Roaming\\Upobyd\\edac.exe"	edac.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 340 set thread context of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe
1532	edac.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1532	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	27
PID 340 wrote to memory of 1532	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	27
PID 340 wrote to memory of 1532	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	27
PID 340 wrote to memory of 1532	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	27
PID 1532 wrote to memory of 1128	1532	edac.exe	11
PID 1532 wrote to memory of 1128	1532	edac.exe	11
PID 1532 wrote to memory of 1128	1532	edac.exe	11
PID 1532 wrote to memory of 1128	1532	edac.exe	11
PID 1532 wrote to memory of 1128	1532	edac.exe	11
PID 1532 wrote to memory of 1204	1532	edac.exe	18
PID 1532 wrote to memory of 1204	1532	edac.exe	18
PID 1532 wrote to memory of 1204	1532	edac.exe	18
PID 1532 wrote to memory of 1204	1532	edac.exe	18
PID 1532 wrote to memory of 1204	1532	edac.exe	18
PID 1532 wrote to memory of 1268	1532	edac.exe	17
PID 1532 wrote to memory of 1268	1532	edac.exe	17
PID 1532 wrote to memory of 1268	1532	edac.exe	17
PID 1532 wrote to memory of 1268	1532	edac.exe	17
PID 1532 wrote to memory of 1268	1532	edac.exe	17
PID 1532 wrote to memory of 340	1532	edac.exe	21
PID 1532 wrote to memory of 340	1532	edac.exe	21
PID 1532 wrote to memory of 340	1532	edac.exe	21
PID 1532 wrote to memory of 340	1532	edac.exe	21
PID 1532 wrote to memory of 340	1532	edac.exe	21
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28
PID 340 wrote to memory of 1588	340	f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe	28

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe
  "C:\Users\Admin\AppData\Local\Temp\f8d8d86143bc5df811724f9729118ea9b4a11d321b80dd5fb6cd15a760cfacc8.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Users\Admin\AppData\Roaming\Upobyd\edac.exe
    "C:\Users\Admin\AppData\Roaming\Upobyd\edac.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\SRK8D50.bat"
    3⤵
    - Deletes itself
    PID:1588

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SRK8D50.bat

Filesize
303B

MD5
0a37edde5c0985c4259a972cedc2adb7

SHA1
cb0290433bda58c1305277800d64e527d3410013

SHA256
fc262a5f25c635a4b6ce4ecd5cba9113849bebc660c95f800ebcb00fc2e08275

SHA512
bea7c8efdd5926997bc2344725c1d3ecaa59e51e5c6d9326e7617717f8a0af4aa05120ace1d868e4ace117c850a612f1cc1204fcfe4d8afe8c74ceb5c4e45295

Download Submit
C:\Users\Admin\AppData\Roaming\Upobyd\edac.exe

Filesize
292KB

MD5
6b8412eba6c3dfbd912d31c39120c94c

SHA1
1365e582293bb14748d6d119f22ca96a41aea4d2

SHA256
5a37e9a3057bc0f87eadb194f19cae768ed74337f05e0a445a6152276ac222a8

SHA512
6416551e176a4e94f160fa401306d19a29b9864c792c80c5cd3663863daf07b3b9a935af9c054c7ab85f84c882a4a164a15c45851d84545cdc9270fb4f8681ae

Download Submit
C:\Users\Admin\AppData\Roaming\Upobyd\edac.exe

Filesize
292KB

MD5
6b8412eba6c3dfbd912d31c39120c94c

SHA1
1365e582293bb14748d6d119f22ca96a41aea4d2

SHA256
5a37e9a3057bc0f87eadb194f19cae768ed74337f05e0a445a6152276ac222a8

SHA512
6416551e176a4e94f160fa401306d19a29b9864c792c80c5cd3663863daf07b3b9a935af9c054c7ab85f84c882a4a164a15c45851d84545cdc9270fb4f8681ae

Download Submit
\Users\Admin\AppData\Roaming\Upobyd\edac.exe

Filesize
292KB

MD5
6b8412eba6c3dfbd912d31c39120c94c

SHA1
1365e582293bb14748d6d119f22ca96a41aea4d2

SHA256
5a37e9a3057bc0f87eadb194f19cae768ed74337f05e0a445a6152276ac222a8

SHA512
6416551e176a4e94f160fa401306d19a29b9864c792c80c5cd3663863daf07b3b9a935af9c054c7ab85f84c882a4a164a15c45851d84545cdc9270fb4f8681ae

Download Submit
\Users\Admin\AppData\Roaming\Upobyd\edac.exe

Filesize
292KB

MD5
6b8412eba6c3dfbd912d31c39120c94c

SHA1
1365e582293bb14748d6d119f22ca96a41aea4d2

SHA256
5a37e9a3057bc0f87eadb194f19cae768ed74337f05e0a445a6152276ac222a8

SHA512
6416551e176a4e94f160fa401306d19a29b9864c792c80c5cd3663863daf07b3b9a935af9c054c7ab85f84c882a4a164a15c45851d84545cdc9270fb4f8681ae

Download Submit
memory/340-103-0x0000000002750000-0x0000000002798000-memory.dmp

Filesize
288KB

Download
memory/340-92-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/340-54-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/340-85-0x0000000002750000-0x0000000002798000-memory.dmp

Filesize
288KB

Download
memory/340-94-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/340-93-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/340-55-0x0000000000401000-0x0000000000441000-memory.dmp

Filesize
256KB

Download
memory/340-56-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/340-91-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/340-90-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/340-89-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/340-88-0x0000000002750000-0x0000000002798000-memory.dmp

Filesize
288KB

Download
memory/340-87-0x0000000002750000-0x0000000002798000-memory.dmp

Filesize
288KB

Download
memory/340-86-0x0000000002750000-0x0000000002798000-memory.dmp

Filesize
288KB

Download
memory/1128-68-0x0000000001E60000-0x0000000001EA8000-memory.dmp

Filesize
288KB

Download
memory/1128-70-0x0000000001E60000-0x0000000001EA8000-memory.dmp

Filesize
288KB

Download
memory/1128-65-0x0000000001E60000-0x0000000001EA8000-memory.dmp

Filesize
288KB

Download
memory/1128-67-0x0000000001E60000-0x0000000001EA8000-memory.dmp

Filesize
288KB

Download
memory/1128-69-0x0000000001E60000-0x0000000001EA8000-memory.dmp

Filesize
288KB

Download
memory/1204-74-0x0000000001D60000-0x0000000001DA8000-memory.dmp

Filesize
288KB

Download
memory/1204-75-0x0000000001D60000-0x0000000001DA8000-memory.dmp

Filesize
288KB

Download
memory/1204-73-0x0000000001D60000-0x0000000001DA8000-memory.dmp

Filesize
288KB

Download
memory/1204-76-0x0000000001D60000-0x0000000001DA8000-memory.dmp

Filesize
288KB

Download
memory/1268-79-0x0000000002920000-0x0000000002968000-memory.dmp

Filesize
288KB

Download
memory/1268-81-0x0000000002920000-0x0000000002968000-memory.dmp

Filesize
288KB

Download
memory/1268-82-0x0000000002920000-0x0000000002968000-memory.dmp

Filesize
288KB

Download
memory/1268-80-0x0000000002920000-0x0000000002968000-memory.dmp

Filesize
288KB

Download
memory/1532-62-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1588-97-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1588-101-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1588-99-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1588-105-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-106-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-107-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-108-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-109-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-110-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-111-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1588-112-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download
memory/1588-100-0x0000000000050000-0x0000000000098000-memory.dmp

Filesize
288KB

Download