Analysis
-
max time kernel
238s -
max time network
283s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:49
Static task
static1
Behavioral task
behavioral1
Sample
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe
Resource
win10v2004-20221111-en
General
-
Target
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe
-
Size
134KB
-
MD5
5c9886c5640c5e125e6640314db6d216
-
SHA1
b5ecf8c1bfcc8550644b3fe78ff07a344f95ec1c
-
SHA256
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473
-
SHA512
a16d5d68f8cdc726cdb4d77cbb0a3ec41bd8b51aedb06c206cab3eae904fd321323085cc7f65afee354fb8f9d0615e87830cb2f2a61ba3b62058560a9ce2e8df
-
SSDEEP
3072:ncw9JIpFWgCcw2OPdZm+UyidxE9oVjB1jz4oUSod2oewM:RJIpFWgCP/Pb2ymxQK/lSgp
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe ,C:\\Users\\Admin\\AppData\\Local\\Temp\\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe" d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe -
Disables use of System Restore points 1 TTPs
-
Processes:
resource yara_rule behavioral2/memory/1408-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-146-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exed83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exedescription pid process target process PID 1528 set thread context of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 set thread context of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exepid process 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exed83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exepid process 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exed83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exed83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exedescription pid process target process PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1528 wrote to memory of 1408 1528 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 1408 wrote to memory of 3508 1408 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe PID 3508 wrote to memory of 2888 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe Explorer.EXE PID 3508 wrote to memory of 2888 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe Explorer.EXE PID 3508 wrote to memory of 2888 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe Explorer.EXE PID 3508 wrote to memory of 2888 3508 d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe"C:\Users\Admin\AppData\Local\Temp\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe"C:\Users\Admin\AppData\Local\Temp\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe"3⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe"C:\Users\Admin\AppData\Local\Temp\d83275ce64fbca91202817bcc2cb23031484f7f13627277d84e5761e9ff0b473.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1408-134-0x0000000000000000-mapping.dmp
-
memory/1408-135-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1408-137-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1408-139-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1408-142-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1408-146-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1528-138-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/2888-148-0x000000007FFF0000-0x000000007FFF7000-memory.dmpFilesize
28KB
-
memory/3508-143-0x0000000000000000-mapping.dmp
-
memory/3508-144-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3508-147-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3508-149-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB