deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81

Analysis

max time kernel
6s
max time network
91s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81.exe
Size

71KB
MD5

a2b1ce416af5e785d381bf56d4573e50
SHA1

9b141c7b5a091131e8833f76a3c8c68eaa97df65
SHA256

deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81
SHA512

550013e371916d698cc35fdcf4e279eb2d818ee4a5600d1c847d9a7b83f8a27c3f0b70ea2b92d0fce31bdee9aef64cbf5cf8fa71f7b40943688013ceae8004fa
SSDEEP

1536:Caf383TCEyY1BtSay1sApJp1OfYLtkOtoPNJWWWWZl7f+:CaPNYpSoAvAYLtZtoPNZm

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\r.exe = "C:\\Windows\\system32\\zltkbr.exe"	deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zltkbr.exe	deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81.exe

C:\Users\Admin\AppData\Local\Temp\deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81.exe
"C:\Users\Admin\AppData\Local\Temp\deb2c082fe15c650950e12a84e2377dd80275fe67b85589aba49f232994bed81.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000000400000-0x0000000000412D23-memory.dmp

Filesize
75KB

Download