Analysis
-
max time kernel
149s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe
Resource
win10v2004-20221111-en
General
-
Target
cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe
-
Size
64KB
-
MD5
a2e6974898a15c0462fee8e10f16a745
-
SHA1
fc9e925758d53ce8f5ae94ce0950ec1689448cdc
-
SHA256
cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa
-
SHA512
1d666c786b25b5c4965a2d9fc821f803ffcd5e946b0346c7b5ae77561106458fdff5e2ab91f17d58dc2d22355f8793ec36c990d2353b75b6890f064a390fda9f
-
SSDEEP
768:uBVEmPwQdi0DLr4OCfCBFd0qX+l5/yo7X34zVwcQUpdPwaeWvJ+XCDDAihvESIXw:uUegaBFp0h7XoB7QUpFOWwXtiZyXGP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
edg144C.exepid process 940 edg144C.exe -
Deletes itself 1 IoCs
Processes:
edg144C.exepid process 940 edg144C.exe -
Loads dropped DLL 2 IoCs
Processes:
cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exepid process 1972 cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe 1972 cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exedescription pid process target process PID 1972 wrote to memory of 940 1972 cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe edg144C.exe PID 1972 wrote to memory of 940 1972 cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe edg144C.exe PID 1972 wrote to memory of 940 1972 cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe edg144C.exe PID 1972 wrote to memory of 940 1972 cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe edg144C.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe"C:\Users\Admin\AppData\Local\Temp\cd37b9e56a49cfae8e40e3317950270699f94a70b3be39365073cf97b4ade3fa.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\edg144C.exeC:\Users\Admin\AppData\Local\edg144C.exe C:\Users\Admin\AppData\Local\Temp\CD37B9~1.EXE cp2⤵
- Executes dropped EXE
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\edg144C.exeFilesize
64KB
MD5e9ba4c186c4ccd8c04f5e80c6c3f15e6
SHA11f3e69628070e7d36279f51d02fcdfa7b143d097
SHA256b8e7f38bf6c78d592f0f43cbaa59b28b397a95e59dd7db5a99d892a6a237280d
SHA512b6a43aa7996c938684ce4264feba63b2dfc9f1ac3d26966722e57ed07948e89863d63aad9c545bc0af4820b07195db4b2c418d849f8041f449eb05f58a4a1941
-
\Users\Admin\AppData\Local\edg144C.exeFilesize
64KB
MD5e9ba4c186c4ccd8c04f5e80c6c3f15e6
SHA11f3e69628070e7d36279f51d02fcdfa7b143d097
SHA256b8e7f38bf6c78d592f0f43cbaa59b28b397a95e59dd7db5a99d892a6a237280d
SHA512b6a43aa7996c938684ce4264feba63b2dfc9f1ac3d26966722e57ed07948e89863d63aad9c545bc0af4820b07195db4b2c418d849f8041f449eb05f58a4a1941
-
\Users\Admin\AppData\Local\edg144C.exeFilesize
64KB
MD5e9ba4c186c4ccd8c04f5e80c6c3f15e6
SHA11f3e69628070e7d36279f51d02fcdfa7b143d097
SHA256b8e7f38bf6c78d592f0f43cbaa59b28b397a95e59dd7db5a99d892a6a237280d
SHA512b6a43aa7996c938684ce4264feba63b2dfc9f1ac3d26966722e57ed07948e89863d63aad9c545bc0af4820b07195db4b2c418d849f8041f449eb05f58a4a1941
-
memory/940-63-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/1972-55-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB