f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9

Analysis

max time kernel
179s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
Size

60KB
MD5

10479d68ffecf5772b8b6c73d1f2d771
SHA1

be102391884d02bc942eb61f4ae9c7a9c32d7d2d
SHA256

f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9
SHA512

f41e0a2b91a77763863acfab0841828443c6d782a414bf110248e37793ea2022ea7e2f49bf270f1afe52864b2b71d4a304897a9910dd5d8cf8dfd3be1cce5435
SSDEEP

768:9gL1wX+h9ipfaADEzxQSs3l/b5ZQEu15C04BkPCJao1asB3Z:9gu+h9i5aADWWljQEu1YJBkP5o1LB3Z

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1084	NÒldr.exe
2400	NÒldr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NT4 hosting service = "C:\\Windows\\system32\\NÒldr.exe"	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	NÒldr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NT4 hosting service = "C:\\Windows\\system32\\NÒldr.exe"	NÒldr.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RCXF225.tmp	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
File opened for modification	C:\Windows\SysWOW64\NÒldr.exe	NÒldr.exe
File created	C:\Windows\SysWOW64\NÒldr.exe	NÒldr.exe
File opened for modification	C:\Windows\SysWOW64\NÒldr.exe	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
File created	C:\Windows\SysWOW64\NÒldr.exe	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1084	4340	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe	82
PID 4340 wrote to memory of 1084	4340	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe	82
PID 4340 wrote to memory of 1084	4340	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe	82
PID 4340 wrote to memory of 2312	4340	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe	83
PID 4340 wrote to memory of 2312	4340	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe	83
PID 4340 wrote to memory of 2312	4340	f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe	83
PID 1084 wrote to memory of 2400	1084	NÒldr.exe	84
PID 1084 wrote to memory of 2400	1084	NÒldr.exe	84
PID 1084 wrote to memory of 2400	1084	NÒldr.exe	84

C:\Users\Admin\AppData\Local\Temp\f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
"C:\Users\Admin\AppData\Local\Temp\f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\NÒldr.exe
  "C:\Windows\system32\NÒldr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\NÒldr.exe
    C:\Windows\SysWOW64\NÒldr.exe
    3⤵
    - Executes dropped EXE
    PID:2400
- C:\Users\Admin\AppData\Local\Temp\f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
  C:\Users\Admin\AppData\Local\Temp\f96f783f85a4df479ad7b43f5b1daf11485284bd27cd5c19802bf66d899e2ce9.exe
  2⤵
  PID:2312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
C:\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit
C:\Windows\SysWOW64\NÒldr.exe

Filesize
21KB

MD5
9e925ed0f4491d242f4cf4d0e2387390

SHA1
398a58119f3ae6b20b8fbf7064f0eb79e217509b

SHA256
7390e0d0482616d4a34a1d02716597170e15b5902b1b147f91d29044fbfbd727

SHA512
8b6237e1b6ba1982023e02c4dcf3ba06ad29d73bdcdd12ca31d708aadb35067358b35c6ecbdf0a61328f12a78baa4eb10805da9b24b706845a669a67857aaa27

Download Submit