c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe
Size

143KB
MD5

63473ced60fd59c5e3df181249e52a03
SHA1

2ded53e99779a80b9d081eedf58488a0f6ed4237
SHA256

c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48
SHA512

bd83a34ac6d3211f69a500f69e3c5aa9e25d1c870bbdd6fb388cb753d1b2197bbf3f944009d406493f557da75d151be22bfca6dce179ab9e7ac0f11b7e53a37d
SSDEEP

3072:YUAAk2JVlGAb5xlXIk8/ozs43Ry5AXEP7zzrVHCZ63NvvX:YOk2VJ5xikw4hy5AXEzHrJv

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4588	regeditnt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	regeditnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Registry NT Save = "\"c:\\windows\\regeditnt.exe\""	regeditnt.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\regeditnt.exe	c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe
File created	C:\Windows\runlog.dat	regeditnt.exe
File created	\??\c:\windows\regeditnt.exe	c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe
4588	regeditnt.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4588	4928	c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe	80
PID 4928 wrote to memory of 4588	4928	c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe	80
PID 4928 wrote to memory of 4588	4928	c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe	80

C:\Users\Admin\AppData\Local\Temp\c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe
"C:\Users\Admin\AppData\Local\Temp\c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- \??\c:\windows\regeditnt.exe
  c:\windows\regeditnt.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\regeditnt.exe

Filesize
143KB

MD5
63473ced60fd59c5e3df181249e52a03

SHA1
2ded53e99779a80b9d081eedf58488a0f6ed4237

SHA256
c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48

SHA512
bd83a34ac6d3211f69a500f69e3c5aa9e25d1c870bbdd6fb388cb753d1b2197bbf3f944009d406493f557da75d151be22bfca6dce179ab9e7ac0f11b7e53a37d

Download Submit
\??\c:\windows\regeditnt.exe

Filesize
143KB

MD5
63473ced60fd59c5e3df181249e52a03

SHA1
2ded53e99779a80b9d081eedf58488a0f6ed4237

SHA256
c039d0e3e09a110a4165b3f39ead09848f68bfe85f58868c99707e947d943c48

SHA512
bd83a34ac6d3211f69a500f69e3c5aa9e25d1c870bbdd6fb388cb753d1b2197bbf3f944009d406493f557da75d151be22bfca6dce179ab9e7ac0f11b7e53a37d

Download Submit
memory/4588-140-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/4588-142-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/4928-132-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/4928-141-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download