2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d

Analysis

max time kernel
61s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe
Size

162KB
MD5

0ac18ae1df521bfb9b1a4cc4d2cbb170
SHA1

00b374204fd8effefbaa0ca002cc05a79d0f765d
SHA256

2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d
SHA512

253ddc30c960dafb407a11a5c70e5a8e3e1c290452d3c74892954d9c9859a6c87c82362b945f462b3240e4977c3bc4362484df901ee4196b4fc1865e58a57f7b
SSDEEP

3072:ZliwDUWyFcB9fu+JMl2uU82Ws7f9sjboPACTQembG4hY/i1vAE:ZldD1Yc7GIBgbzjbfLhRWE

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1760	nswitkh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nswitkh.exe	2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe
File created	C:\PROGRA~3\Mozilla\zgooxfa.dll	nswitkh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1760	1124	taskeng.exe	29
PID 1124 wrote to memory of 1760	1124	taskeng.exe	29
PID 1124 wrote to memory of 1760	1124	taskeng.exe	29
PID 1124 wrote to memory of 1760	1124	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe
"C:\Users\Admin\AppData\Local\Temp\2a83a871b43545ff86640c2ae36bd3b64903f850dfd5ccc97acbe52b1f63839d.exe"
1⤵
- Drops file in Program Files directory
PID:1892

C:\Windows\system32\taskeng.exe
taskeng.exe {15CD5328-37FC-4AD2-9F4A-B007E8C8A588} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\PROGRA~3\Mozilla\nswitkh.exe
  C:\PROGRA~3\Mozilla\nswitkh.exe -vhgoixm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
62KB

MD5
57b0781f8c1279f11df5dcfc30e5404f

SHA1
7de6b4a75c189f684f49267cfda7f57f46862b04

SHA256
b68d1f2155b7c0f23c03107f5e6bc7e3717ae73e3169cee9222b4845b53e154f

SHA512
9dcb9e0c62a93f44df82804db48de65ff11114cd68ba0effa93b70c213a4ef202b9fe2298cf5d381c93a9485085e9191f8c9c084f809b3de1d9f8a54610052ad

Download Submit
C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
54KB

MD5
e8321afd3d7fac12c921295bb260fb51

SHA1
a044ca0b0540792589fb29dbfd96e429e387beb9

SHA256
67763bbee1636aa28928c871bc32baac7ea79848f04fcfcea98f1d70330e09d1

SHA512
c7252424a43626668e0d29996218093586762adf2a684a88df2b43e20f45874e3d417986260da28e3bb9f257bd4ac9354024dfe8e2f5e1a18560e7c1cc2be075

Download Submit
memory/1760-66-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1760-64-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1760-69-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1760-70-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1892-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1892-56-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1892-54-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1892-59-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1892-60-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download