3bea71d45791a91033323dca0480e1be92e46fd1a621c2668eb8d474e9bc6d83

Analysis

max time kernel
185s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bea71d45791a91033323dca0480e1be92e46fd1a621c2668eb8d474e9bc6d83.exe
Size

224KB
MD5

a318643b9792e86da520cf0c5aedb380
SHA1

0619b9b2362c643821443c5d538abeddda6fc032
SHA256

3bea71d45791a91033323dca0480e1be92e46fd1a621c2668eb8d474e9bc6d83
SHA512

79c184e36a72aa3daa875baa33c7a15886832a04c7478b3d7cf3f1d0488529f4a570b781a98fc4447544ed6f087d69c3d84a90f15c7ef7f193394b2a32f1de7b
SSDEEP

6144:T44b7czK+MOjoF3/di++08qvFsRcfJgo5:84fijVjo1Fimlvybo5

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3336	znblaln.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\znblaln.exe	3bea71d45791a91033323dca0480e1be92e46fd1a621c2668eb8d474e9bc6d83.exe
File created	C:\PROGRA~3\Mozilla\czmmuxc.dll	znblaln.exe

C:\Users\Admin\AppData\Local\Temp\3bea71d45791a91033323dca0480e1be92e46fd1a621c2668eb8d474e9bc6d83.exe
"C:\Users\Admin\AppData\Local\Temp\3bea71d45791a91033323dca0480e1be92e46fd1a621c2668eb8d474e9bc6d83.exe"
1⤵
- Drops file in Program Files directory
PID:1448

C:\PROGRA~3\Mozilla\znblaln.exe
C:\PROGRA~3\Mozilla\znblaln.exe -irlyaih
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\znblaln.exe

Filesize
224KB

MD5
6be06979b3ef4e6ca7aeccd97969a114

SHA1
1513f61971ed856f92912827f2f1b2dbf5e8d7e0

SHA256
1ce406e34236d75839c50c52fbda71ca70369ed2c52bd9902b1d4249c63645ba

SHA512
0eba36786f37cae850217866dad09cdf1dbb8619509d38ce01dc3dfa8acc27c4342438bdc9d5cd82f15bc4d39f8185ad50333af38149d0025e30913f0b08c3a9

Download Submit
C:\ProgramData\Mozilla\znblaln.exe

Filesize
224KB

MD5
6be06979b3ef4e6ca7aeccd97969a114

SHA1
1513f61971ed856f92912827f2f1b2dbf5e8d7e0

SHA256
1ce406e34236d75839c50c52fbda71ca70369ed2c52bd9902b1d4249c63645ba

SHA512
0eba36786f37cae850217866dad09cdf1dbb8619509d38ce01dc3dfa8acc27c4342438bdc9d5cd82f15bc4d39f8185ad50333af38149d0025e30913f0b08c3a9

Download Submit
memory/1448-132-0x00000000021C0000-0x000000000221B000-memory.dmp

Filesize
364KB

Download
memory/1448-133-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1448-136-0x00000000021C0000-0x000000000221B000-memory.dmp

Filesize
364KB

Download
memory/1448-137-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1448-138-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3336-139-0x0000000000D40000-0x0000000000D9B000-memory.dmp

Filesize
364KB

Download
memory/3336-140-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3336-141-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download