eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366

Analysis

max time kernel
180s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe
Size

95KB
MD5

0424755b0000ad2a6abfd172ad76bb30
SHA1

1dfeeb2206f2e1e365a4e01b124eb4479eeecd37
SHA256

eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366
SHA512

b0bcd319c9fbe9b7666f9830ed38b8c27d3810b0996417501a6f3a429d52525c193938b03aba50def8b21f56b9feb537a46c9edf08a05db52e6874c25ec99f4d
SSDEEP

1536:0VyU+KE8EME7C/MSPt9IhffgZB+ST7plGvAX9dst2euj/yQ9QEDkOZxyTl+5FMh1:WaKE8EME7mM24IZB/T7plGYUNbXOvu

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\htpgudlj = "\"C:\\Users\\Admin\\AppData\\Local\\pvqucnpu.exe\""	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3376 set thread context of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4364	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe
4364	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 3376 wrote to memory of 4364	3376	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	77
PID 4364 wrote to memory of 4412	4364	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	78
PID 4364 wrote to memory of 4412	4364	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	78
PID 4364 wrote to memory of 4412	4364	eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe	78

C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe
"C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe
  "C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Adds Run key to start application
    PID:4412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3376-136-0x0000000000010000-0x000000000002B000-memory.dmp

Filesize
108KB

Download
memory/4364-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4364-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4364-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4364-139-0x0000000000010000-0x000000000002B000-memory.dmp

Filesize
108KB

Download
memory/4412-138-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/4412-140-0x0000000000900000-0x0000000000911000-memory.dmp

Filesize
68KB

Download
memory/4412-141-0x0000000000ED0000-0x0000000000F50000-memory.dmp

Filesize
512KB

Download
memory/4412-142-0x0000000000ED0000-0x0000000000F50000-memory.dmp

Filesize
512KB

Download