8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef

Analysis

max time kernel
41s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe
Size

408KB
MD5

0998745cef26190da843f62db352a540
SHA1

46966f09d513039c5b6311865adddff2e52a88e4
SHA256

8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef
SHA512

bcc04fb0800970a82775ebc73ffc88c269961a7b14c77a516516ece1ace709c881fec1e58617ca05b88dc0bc92ec8e7a7f311ca00790dcea91ced2bec88d7aad
SSDEEP

6144:wc1aCuVzCv4u12NtMPiZxWQ6Sro+jAlAbmlMfUcLzH3ljY98rc/b5K:wTzCQhkPyNroybmlotLhY0A5K

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

pid process

1316 8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

pid	process
1316	8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OsluxEposu = "regsvr32.exe \"C:\\ProgramData\\OsluxEposu\\OsluxEposu.dat\""	8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

Modifies registry class 2 IoCs

Processes:

8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\CLSID\{3B7E1DCB-5C9C-4A2C-B1DE-3E55103D7ECF}	8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\CLSID\{3B7E1DCB-5C9C-4A2C-B1DE-3E55103D7ECF}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c386334323431346265356137663565396136633831353038316633306235393063613030643064383439656539653132353834373237623733316532373765662e65786500	8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe

C:\Users\Admin\AppData\Local\Temp\8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe
"C:\Users\Admin\AppData\Local\Temp\8c42414be5a7f5e9a6c815081f30b590ca00d0d849ee9e12584727b731e277ef.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OsluxEposu\OsluxEposu.dat
Filesize
240KB

MD5
9091f58832d2d1fd2ed95a24c4e27a6a

SHA1
a92545dd660abd2ebd57e38fdd784cc81d6ed48c

SHA256
e4ad24fb445751d486a5058cd996f4b15ccf06935ea8aaf2920154fbdd55793d

SHA512
be031613a4b72187a748e02f21c6107d6f9bc36f6ed60c319902a4e6aaa916ff64bf1699d543ae456bc16b06a5191db286a009ff2f1b9566ee24e3e86e85c3c1

Download Submit
memory/1316-132-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1316-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1316-136-0x00000000747C0000-0x0000000074825000-memory.dmp

Filesize
404KB

Download
memory/1316-137-0x00000000747C0000-0x00000000747F1000-memory.dmp

Filesize
196KB

Download
memory/1316-139-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download