accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163

Analysis

max time kernel
169s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
Size

136KB
MD5

4c8822dab709726b0f02125a8ea28dc5
SHA1

526cb3cc2d7eafa5f3db04d799c7df5bf29ee6a8
SHA256

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163
SHA512

866d8fe9525aa6ab6330ff14e73b68c0f5dc92696687d7fa2e0e7155c6d3ca86dde7e6de95c55cbcb920dffd33306425d8bbae1d214e40b66d6b25b80d15cba0
SSDEEP

3072:bEH+GiEs2SMylNOjyFbxJQ5eNLOxPAkRckhu5pYAQruaZ6Mv:bsehzRF/LmRcD42JE

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ucbr.exe

pid process

2852 ucbr.exe

pid	process
2852	ucbr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe

description	pid	process	target process
PID 4520 wrote to memory of 2852	4520	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 4520 wrote to memory of 2852	4520	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe
PID 4520 wrote to memory of 2852	4520	accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe	ucbr.exe

C:\Users\Admin\AppData\Local\Temp\accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe
"C:\Users\Admin\AppData\Local\Temp\accac86b13264a7134ce9cb4e8d180037da482127dbb3cf32c124745c9c60163.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4520

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe
2⤵
- Executes dropped EXE
PID:2852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe
Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ucbr.exe
Filesize
182KB

MD5
4d278755afc1cc0e38895363dd45e6c8

SHA1
a3af31a6be6e44efa62b940b71fddc3d6d5ed6a6

SHA256
b3825ea4e00cba88ad8e320b30ec1dc8cc22b77ed64f10882c822c04846e2cd6

SHA512
735ab551444ac137a471c476b0c69464d6a6b339ae16a3a32a71f9eefce62a9632320e4712ba77b77a0d610c997f6ff384012c843a3e76e9d38fc93515d06bd4

Download Submit
memory/2852-132-0x0000000000000000-mapping.dmp

Download