Analysis
-
max time kernel
159s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 23:17
General
-
Target
3ad73fe0e78591d5c4c2867508f75dd3ff14fc297e2ceaee8f5495cd2d4adf49.exe
-
Size
1.5MB
-
MD5
2c042d70ee18f2597887a108798c5d65
-
SHA1
60e8baf0ea5072acb7652a5467601612e0305564
-
SHA256
3ad73fe0e78591d5c4c2867508f75dd3ff14fc297e2ceaee8f5495cd2d4adf49
-
SHA512
a190f545271e3d094fbe363739347c98d11d8ee4a34f81ac11c7c32bf5930a46ec6bb9c9c71206aede5a4a292664de64902bdc2547582b03b4122a7477aa021a
-
SSDEEP
24576:BI0M24BCieyhLZ/UTEGWCyLwMRQRbISyRezKrQA4kKcBCjp9rgHudzrDdXX:nnFl0qAcnjAu/dH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 13 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ad73fe0e78591d5c4c2867508f75dd3ff14fc297e2ceaee8f5495cd2d4adf49.exe"C:\Users\Admin\AppData\Local\Temp\3ad73fe0e78591d5c4c2867508f75dd3ff14fc297e2ceaee8f5495cd2d4adf49.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\server.binc:\server.bin2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe c:\Progra~1\dnf\lcydrxqqd.dll Run3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del c:\server.bin3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\server.binFilesize
42KB
MD5c7b39eefb691e43a2db01008eb0435b6
SHA1e643e4d2f6022f1b64bc94e216e64c9adbe0ba79
SHA256c94bdc087b5be53ad424c2538b73b0c81cf95515389633473eabb3e5efa08553
SHA5129c32e8a8b109fdf9447afd6e174f0b26adf996d44258299a08cea58b772ebff2626aaa8d5ecb8c24e54198149a7ab942aafcc7ca5bead269e05c25bcf9382e47
-
\??\c:\server.binFilesize
42KB
MD5c7b39eefb691e43a2db01008eb0435b6
SHA1e643e4d2f6022f1b64bc94e216e64c9adbe0ba79
SHA256c94bdc087b5be53ad424c2538b73b0c81cf95515389633473eabb3e5efa08553
SHA5129c32e8a8b109fdf9447afd6e174f0b26adf996d44258299a08cea58b772ebff2626aaa8d5ecb8c24e54198149a7ab942aafcc7ca5bead269e05c25bcf9382e47
-
\Windows\SysWOW64\lcydrxqqd.dllFilesize
84KB
MD5e84d0d3fee861c44009a5087f9dcb169
SHA15fdb91b0f220113715fbc2840688981dbbc09f0c
SHA256df2f4d12e449b300022d4554dc66189c8b9bb1a0f28831e96b026ea085ac25ec
SHA51216f595689fc7fc8ce90d99a2e309ed5b3949320a87ae79909277b93e43ca4e5593281601229283773d060897bd57100c4fc95057b3f57e7b3cff55aa2dbebe89
-
memory/468-58-0x0000000000000000-mapping.dmp
-
memory/760-60-0x0000000000000000-mapping.dmp
-
memory/900-55-0x0000000000000000-mapping.dmp
-
memory/1332-54-0x0000000075351000-0x0000000075353000-memory.dmpFilesize
8KB