3a1afd6c68c3ff68d53473f1cc1f31c6ab635db62d820793c3e3688e486d203c

Analysis

max time kernel
95s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1afd6c68c3ff68d53473f1cc1f31c6ab635db62d820793c3e3688e486d203c.exe
Size

212KB
MD5

a00bc33585fa69861ac224c99ebc7390
SHA1

c939b56d048f9a90f942984dbafbf3b24d03054a
SHA256

3a1afd6c68c3ff68d53473f1cc1f31c6ab635db62d820793c3e3688e486d203c
SHA512

b5da6c98797a2643e181787773659c767d6adf49dd3386ceb52ad0e31f783f3d96ad29ad6c32bbf4a5a9fd88e595f20e2c4f09c198d219ebff0e8fc5c0263af9
SSDEEP

6144:mEjpvYc3QxMI7TwmdMlL992VKmKmn1Dk1i7YqysF:xVnB3R2RlYYYqlF

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
384	znblaln.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\znblaln.exe	3a1afd6c68c3ff68d53473f1cc1f31c6ab635db62d820793c3e3688e486d203c.exe
File created	C:\PROGRA~3\Mozilla\czmmuxc.dll	znblaln.exe

C:\Users\Admin\AppData\Local\Temp\3a1afd6c68c3ff68d53473f1cc1f31c6ab635db62d820793c3e3688e486d203c.exe
"C:\Users\Admin\AppData\Local\Temp\3a1afd6c68c3ff68d53473f1cc1f31c6ab635db62d820793c3e3688e486d203c.exe"
1⤵
- Drops file in Program Files directory
PID:4928

C:\PROGRA~3\Mozilla\znblaln.exe
C:\PROGRA~3\Mozilla\znblaln.exe -irlyaih
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\znblaln.exe

Filesize
213KB

MD5
60238faa83031ef056fdff1c03d4a1cd

SHA1
c5420cd8882a0b3e995b5a3f11702083a85fa12b

SHA256
779a9a84b715237ea193d06955dc54a2d15b36d481b4815f58a81c39070b69fb

SHA512
4e04acefd13a32a1759195d3a2c4bb5ead608715a886fff15d2bfe2000064e457f41b485f83172c12ade7310b5c538360b820f5f112253d7bc6d6dee0cf7abf4

Download Submit
C:\ProgramData\Mozilla\znblaln.exe

Filesize
213KB

MD5
60238faa83031ef056fdff1c03d4a1cd

SHA1
c5420cd8882a0b3e995b5a3f11702083a85fa12b

SHA256
779a9a84b715237ea193d06955dc54a2d15b36d481b4815f58a81c39070b69fb

SHA512
4e04acefd13a32a1759195d3a2c4bb5ead608715a886fff15d2bfe2000064e457f41b485f83172c12ade7310b5c538360b820f5f112253d7bc6d6dee0cf7abf4

Download Submit
memory/384-143-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/384-144-0x0000000001020000-0x000000000107B000-memory.dmp

Filesize
364KB

Download
memory/4928-135-0x0000000002560000-0x00000000025BB000-memory.dmp

Filesize
364KB

Download
memory/4928-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download