ade3cb4d8d6dc56650eb1b32afb7cf7797c52d262a686db30aca473754b7029d

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.2MB
Sample221102-e3netshcg2
SHA256 ade3cb4d8d6dc56650eb1b32afb7cf7797c52d262a686db30aca473754b7029d
MD5 862a5b2d76dda73717946179ada16c1e
SHA1 dced9a91f121460d812e3dabcc3289a7af4a5323
SHA512 285e7ff0ca805d6da3ac3af0807752a8c7f837e8a931b571d29e91a93032dc11737dde84709fb0cfd12e61067cb681b6ae9c303b6b610977006e38965ea3bbeb
SSDEEP 98304:m9UbUbRg7Qxtuk9yaPl7OpxqQ8L5/d/EifMwOBk/pOue:MR6ExN9MEL5V/NfMwWIe
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
624	Apparel.exe.pif

Loads dropped DLL 1 IoCs

pid	Process
856	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1424	tasklist.exe
1936	tasklist.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1208	PING.EXE
872	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
624	Apparel.exe.pif
624	Apparel.exe.pif
624	Apparel.exe.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1424	tasklist.exe
Token: SeDebugPrivilege	1936	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
624	Apparel.exe.pif
624	Apparel.exe.pif
624	Apparel.exe.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
624	Apparel.exe.pif
624	Apparel.exe.pif
624	Apparel.exe.pif

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1996	1048	file.exe	27
PID 1048 wrote to memory of 1996	1048	file.exe	27
PID 1048 wrote to memory of 1996	1048	file.exe	27
PID 1048 wrote to memory of 1996	1048	file.exe	27
PID 1048 wrote to memory of 1512	1048	file.exe	29
PID 1048 wrote to memory of 1512	1048	file.exe	29
PID 1048 wrote to memory of 1512	1048	file.exe	29
PID 1048 wrote to memory of 1512	1048	file.exe	29
PID 1512 wrote to memory of 856	1512	cmd.exe	31
PID 1512 wrote to memory of 856	1512	cmd.exe	31
PID 1512 wrote to memory of 856	1512	cmd.exe	31
PID 1512 wrote to memory of 856	1512	cmd.exe	31
PID 856 wrote to memory of 1424	856	cmd.exe	32
PID 856 wrote to memory of 1424	856	cmd.exe	32
PID 856 wrote to memory of 1424	856	cmd.exe	32
PID 856 wrote to memory of 1424	856	cmd.exe	32
PID 856 wrote to memory of 1292	856	cmd.exe	33
PID 856 wrote to memory of 1292	856	cmd.exe	33
PID 856 wrote to memory of 1292	856	cmd.exe	33
PID 856 wrote to memory of 1292	856	cmd.exe	33
PID 856 wrote to memory of 1936	856	cmd.exe	35
PID 856 wrote to memory of 1936	856	cmd.exe	35
PID 856 wrote to memory of 1936	856	cmd.exe	35
PID 856 wrote to memory of 1936	856	cmd.exe	35
PID 856 wrote to memory of 688	856	cmd.exe	36
PID 856 wrote to memory of 688	856	cmd.exe	36
PID 856 wrote to memory of 688	856	cmd.exe	36
PID 856 wrote to memory of 688	856	cmd.exe	36
PID 856 wrote to memory of 1844	856	cmd.exe	37
PID 856 wrote to memory of 1844	856	cmd.exe	37
PID 856 wrote to memory of 1844	856	cmd.exe	37
PID 856 wrote to memory of 1844	856	cmd.exe	37
PID 856 wrote to memory of 624	856	cmd.exe	38
PID 856 wrote to memory of 624	856	cmd.exe	38
PID 856 wrote to memory of 624	856	cmd.exe	38
PID 856 wrote to memory of 624	856	cmd.exe	38
PID 856 wrote to memory of 872	856	cmd.exe	39
PID 856 wrote to memory of 872	856	cmd.exe	39
PID 856 wrote to memory of 872	856	cmd.exe	39
PID 856 wrote to memory of 872	856	cmd.exe	39
PID 1512 wrote to memory of 1208	1512	cmd.exe	40
PID 1512 wrote to memory of 1208	1512	cmd.exe	40
PID 1512 wrote to memory of 1208	1512	cmd.exe	40
PID 1512 wrote to memory of 1208	1512	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\bitsadmin.exe
  bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin bitsadmin
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Cars.pot & ping -n 5 localhost
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    cmd
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AvastUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1424
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avastui.exe"
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "imagename eq AVGUI.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1936
  - - C:\Windows\SysWOW64\find.exe
      find /I /N "avgui.exe"
      4⤵
      PID:688
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^mewNaCMXyg$" Motel.pot
      4⤵
      PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Apparel.exe.pif
      Apparel.exe.pif F
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:624
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 5
      4⤵
      Runs ping.exe
      PID:872
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 5 localhost
    3⤵
    - Runs ping.exe
    PID:1208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Apparel.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Apparel.exe.pif
Size 1.0MB
SHA256 f9a5c663b02e0421f230f1df19e742fc95462e3daad4e689d82f568908f2e346
MD5 37844cb458c9da6d548278c2db6f21f8
SHA1 ada66b029c395ff6c9a4b3f02e873d53cce6354f
SHA512 2ee6faed16caf2aecbc44ac61b37b04574026f6ff4d04f0d70230e7dbc776c9cce00e63e71bcee710d83641c8679d67804394163e6e583e3cf8509e9450d3840
SSDEEP 24576:gZlboYiwpt6/m46VooSqSE67t9NK6EmwsgSSbzYs0YajBw:gZJoYxtEm46mNqSE65zKJF3SSbzYqajC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apparel.exe.pif

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Apparel.exe.pif
Size 1.0MB
SHA256 f9a5c663b02e0421f230f1df19e742fc95462e3daad4e689d82f568908f2e346
MD5 37844cb458c9da6d548278c2db6f21f8
SHA1 ada66b029c395ff6c9a4b3f02e873d53cce6354f
SHA512 2ee6faed16caf2aecbc44ac61b37b04574026f6ff4d04f0d70230e7dbc776c9cce00e63e71bcee710d83641c8679d67804394163e6e583e3cf8509e9450d3840
SSDEEP 24576:gZlboYiwpt6/m46VooSqSE67t9NK6EmwsgSSbzYs0YajBw:gZJoYxtEm46mNqSE65zKJF3SSbzYqajC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cars.pot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Cars.pot
Size 10KB
SHA256 437cf0051096f371b3af444d9eadab08909ffbbce60a499d5d11f6c78eebb2be
MD5 9fea89e0d95fa0adc92b3c14a9a6580d
SHA1 bc2c6331a78790fe36f2f9cfa38992b588b4c7eb
SHA512 e7855c5e8d7f6b8db36f2922a410240437b522bc5154f2260a534bac175acffdc4edef9f3263e334389b627ae2ab1a8e2a605b33fb2d35d0ba380919c7402762
SSDEEP 192:eP1aF6HpgcvRwATmyy9p3f7f8tdfeyB500K:A1GCbZVnm7f8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Motel.pot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Motel.pot
Size 1.0MB
SHA256 4617b05cf7bca46cd937b4daed45e63c40e1d826a36f976a6acaa0d20d2fadb9
MD5 3eefb6b407b3e1f9986712dcf6da0a07
SHA1 558de28d22694c3995db10dfb9c03571acb9cba5
SHA512 931caaa94beedfd150e372a143602d41e892c3319267ee37a242106d1356554fafe4765032a3b490bea52f9e8f539bee8a426a26b234cbd38d464674f4c51383
SSDEEP 24576:iZlboYiwpt6/m46VooSqSE67t9NK6EmwsgSSbzYs0YajBw:iZJoYxtEm46mNqSE65zKJF3SSbzYqajC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Promises.pot

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Promises.pot
Size 5.3MB
SHA256 701836edabb0eaecb7b3ad3eae329e906a9744111c6e48c381954cd8adce3b4e
MD5 c25b5ac7f6ca9babb6ba13549bab5bd2
SHA1 0d18b5dd3809a25fb5215e0bd4b97a44d2498778
SHA512 cdbb3489facc523e49ea5e2d7d5f09b19f5690938a499c5cb95ecf9a98325bdc44135a1af8ed2dc3ca4422651f223f5658843b8ede1013de2221f01c04bd15ce
SSDEEP 24576:QeeuSZlFBZFJxELKosH45YmBfbvz3wsa95D65CGQwIUWzWiiWvT93hjvvZJfnX7L:jelVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Apparel.exe.pif

Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\Apparel.exe.pif
Size 1.0MB
SHA256 f9a5c663b02e0421f230f1df19e742fc95462e3daad4e689d82f568908f2e346
MD5 37844cb458c9da6d548278c2db6f21f8
SHA1 ada66b029c395ff6c9a4b3f02e873d53cce6354f
SHA512 2ee6faed16caf2aecbc44ac61b37b04574026f6ff4d04f0d70230e7dbc776c9cce00e63e71bcee710d83641c8679d67804394163e6e583e3cf8509e9450d3840
SSDEEP 24576:gZlboYiwpt6/m46VooSqSE67t9NK6EmwsgSSbzYs0YajBw:gZJoYxtEm46mNqSE65zKJF3SSbzYqajC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/624-69-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Download

memory/1996-55-0x0000000076171000-0x0000000076173000-memory.dmp

Download