acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf | Triage

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:24

Sharing

Report Analysis Logs

General

Target

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
Size

134KB
MD5

d0202f4ac2fd583d9eb32fd4ff1aff5c
SHA1

951b731626b6d266cd4e5ebf6fecfa0e356ea805
SHA256

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf
SHA512

fe31989e2cbeffb2d74f79e3f940db838fc28d9d93858e64eadf2ba08cf5d358d39166226fbf4b4fa267d573351feeb92fd6895594c1b4b3535315053ae50d4e
SSDEEP

3072:qsRG0fFgblljWFQ8ZrYPVfPLWkTKirRhCRgkHvHTO:lRGC6uNoVfPUirYdHa

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

5024 cmd.exe

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127
Destination IP	85.114.128.127

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{bfcb9398-bfb2-ca3f-1731-e604ea3da242}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{bfcb9398-bfb2-ca3f-1731-e604ea3da242}\\GoogleUpdate.exe\" >"	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

description	pid	process	target process
PID 5060 set thread context of 5024	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

pid	process
5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
2640
2640

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2640
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

pid process

5060 acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

description	pid	process
Token: SeRestorePrivilege	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
Token: SeDebugPrivilege	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
Token: SeDebugPrivilege	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
Token: SeDebugPrivilege	2640

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2640

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe

description	pid	process	target process
PID 5060 wrote to memory of 5024	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe	cmd.exe
PID 5060 wrote to memory of 5024	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe	cmd.exe
PID 5060 wrote to memory of 5024	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe	cmd.exe
PID 5060 wrote to memory of 5024	5060	acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe
"C:\Users\Admin\AppData\Local\Temp\acd1d5e6495240532917fb0a38650fa89dc6ed3d35816b7409817b43f5b9f7cf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:5024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-136-0x0000000000F70000-0x0000000000F81000-memory.dmp

Filesize
68KB

Download
memory/5024-134-0x0000000000000000-mapping.dmp

Download
memory/5060-132-0x0000000001000000-0x000000000103E000-memory.dmp

Filesize
248KB

Download
memory/5060-135-0x0000000001000000-0x000000000103E000-memory.dmp

Filesize
248KB

Download