61e79f00c9262776c817eea41641fbd48eae55b6727ab46c4675a5ae0cad0a71

Analysis

max time kernel
56s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61e79f00c9262776c817eea41641fbd48eae55b6727ab46c4675a5ae0cad0a71.exe
Size

120KB
MD5

842256cb98b99f826714334b17ee07f0
SHA1

bee27964a40c83969eec56f908669eb78c39d751
SHA256

61e79f00c9262776c817eea41641fbd48eae55b6727ab46c4675a5ae0cad0a71
SHA512

10b7aedccef1d0b6a15d6461e046357ddf8212250a87a2dbad40fa3db94c7ef1ab070d5a7e31d45bee118495519c1f95df2eb8232298541500e6fcef17236fd6
SSDEEP

3072:da/O0TixyAve2KbPqGntr6UTTx1kN3PvJh951jevBGgoQRK:da/OlxbUNtrFTVmBvJznSJGbQM

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1740	nswitkh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nswitkh.exe	61e79f00c9262776c817eea41641fbd48eae55b6727ab46c4675a5ae0cad0a71.exe
File created	C:\PROGRA~3\Mozilla\zgooxfa.dll	nswitkh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1740	1760	taskeng.exe	29
PID 1760 wrote to memory of 1740	1760	taskeng.exe	29
PID 1760 wrote to memory of 1740	1760	taskeng.exe	29
PID 1760 wrote to memory of 1740	1760	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\61e79f00c9262776c817eea41641fbd48eae55b6727ab46c4675a5ae0cad0a71.exe
"C:\Users\Admin\AppData\Local\Temp\61e79f00c9262776c817eea41641fbd48eae55b6727ab46c4675a5ae0cad0a71.exe"
1⤵
- Drops file in Program Files directory
PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {44F24488-8DE4-41F9-91C4-349822CD76FA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\PROGRA~3\Mozilla\nswitkh.exe
  C:\PROGRA~3\Mozilla\nswitkh.exe -vhgoixm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
120KB

MD5
31f37b66401e64614d1ddc58ea0c3279

SHA1
c3417f3394f6248e68669a4e53cbe10fcb73f696

SHA256
19bf302f3b278b347b89da71eac240f6ad4d1f7ce3caa7c63808a6c8653a7821

SHA512
1c331d3a992261f3d86033c8c0fab0d2e2951cb7be5ef7f9309465c15d72f8eb781aea4e2d77005133d72070d4bca5acb390cfc46f670d60c1d4ae8ab2ca0c89

Download Submit
C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
120KB

MD5
31f37b66401e64614d1ddc58ea0c3279

SHA1
c3417f3394f6248e68669a4e53cbe10fcb73f696

SHA256
19bf302f3b278b347b89da71eac240f6ad4d1f7ce3caa7c63808a6c8653a7821

SHA512
1c331d3a992261f3d86033c8c0fab0d2e2951cb7be5ef7f9309465c15d72f8eb781aea4e2d77005133d72070d4bca5acb390cfc46f670d60c1d4ae8ab2ca0c89

Download Submit
memory/1668-54-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1668-55-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1668-56-0x0000000000320000-0x000000000037B000-memory.dmp

Filesize
364KB

Download
memory/1740-62-0x0000000000000000-mapping.dmp

Download
memory/1740-64-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1740-69-0x0000000000430000-0x000000000048B000-memory.dmp

Filesize
364KB

Download
memory/1740-68-0x000000000043A000-0x000000000047D000-memory.dmp

Filesize
268KB

Download