Analysis
-
max time kernel
2s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29/10/2022, 01:43
General
-
Target
c6c49d2c8455790495e3b0a6b4a07db585f8b75d64f30ea0d6ef57e9c090f070.exe
-
Size
208KB
-
MD5
042ec980875566c68517a28da400e697
-
SHA1
c67fcdc623d07356b4d7e5314f8b55becf98d5ba
-
SHA256
c6c49d2c8455790495e3b0a6b4a07db585f8b75d64f30ea0d6ef57e9c090f070
-
SHA512
4d68f8a9d51a1eda082eb00fea6d3f36a9088fa70af3c96a7890f954619db87fd87e73357da440cd1841ab0f4a0800630baba783fdbe096462b8f5c300987060
-
SSDEEP
3072:kUpRi1s+S52fNiQGUaqcJeGwxruUIiau038t6eTNzW+XERycnR3FPEtprO8OFb5+:S1wuNiQj4hwBEu0MYqVmXBFPEjRiGdz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c49d2c8455790495e3b0a6b4a07db585f8b75d64f30ea0d6ef57e9c090f070.exe"C:\Users\Admin\AppData\Local\Temp\c6c49d2c8455790495e3b0a6b4a07db585f8b75d64f30ea0d6ef57e9c090f070.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5cb1447b8ec22d78b009059bc60868c43
SHA1c27303f011b2699a781af6e367c96f8e2580d620
SHA25648974b3acad8d0d868828e87500620a29bbdc980bb89faee9c7b1335f7b0889f
SHA512c60b39807a388bcd8274d7edb13171cb338f113684fe542fd0f7f8c6e032aa5315f9830d8dd05d6b2fb1d8ebc6c46113822464331ffbdbadf6770485d1c608f2
-
Filesize
7KB
MD533d32d6f8f6544da747347959c2d3371
SHA12ac567cf3a181b7c226a1a47da76d744dcf55a93
SHA2567cff365ec9d8d6364579d5b03f44599b5bbcd7da8ac14bdbbf51ada58020fe00
SHA512292c2b8018c44c5704d14776f6cf0254e78a66a8a5ec5320a89f2da51418120fa0db4b2902fd5c3872511102f694c91f54a7cc051b1569611febe610511bb0dd
-
Filesize
30KB
MD5e92289647820c9e716e35ca39e44c2ed
SHA1ad14df726c43f83d3b36d9c2d082b4d5360f5804
SHA256a06e8ae2d3eead1d90169c3aa1e0c8e4200a193f032cd6d523402d1cb9089420
SHA512ed06525f0124fb588feb9c9dd4b5193f0dbb665ad4021293e54733ffa4d13c3b50910788cae48bfe76ef9c847b8cc68fec4073b2a83c230d749f18e2ce6d7c8b
-
Filesize
21KB
MD5507a135071bc9369d02798cff20825e9
SHA16a22160a3694ba2115da3977d8d09599ce670522
SHA256817bea028f03aadd0ec63b56a5a194fcdd2c2dbc0c7841246e0194745bc1e791
SHA512c9b3ade45fbe1f0b7b6efcc91b09a3e2f23d7f8c30ca1cbb2c0fe1fc6571fa8d6bc12fce9d71f7902744eb7fd073f364468ac181e580e619b6db908e61af61c0
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
1.3MB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
1.3MB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
328KB
-
Filesize
1.3MB
-
Filesize
8KB