dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe
Size

191KB
MD5

1bb221e3d2d2ff13063d198c71b69013
SHA1

9505301da81c28ef5ad749ec5ecfda7f8eedbc84
SHA256

dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922
SHA512

18ebf60812c44d6f867cc4eaa9cb03b0d3a4cf2c1e4fe1b90b5eda7e94f068e800db2ffb2ffa1e164f7f3b834db577ed30030f966c517f2c7b40ebec28dfd4f0
SSDEEP

3072:2dKIOoL16fecObSCBqjEjINPqhfCAq7RgIECivX5:KKI/LAfecdPojCYbugIEPX

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

ctxmon.exe

pid process

904 ctxmon.exe
Loads dropped DLL 1 IoCs

Processes:

dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe

pid process

1588 dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe

pid	process
904	ctxmon.exe

pid	process
1588	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exectxmon.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yazzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctxmon.exe"	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ctxmon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ctxmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe

description	pid	process	target process
PID 1588 wrote to memory of 904	1588	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe	ctxmon.exe
PID 1588 wrote to memory of 904	1588	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe	ctxmon.exe
PID 1588 wrote to memory of 904	1588	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe	ctxmon.exe
PID 1588 wrote to memory of 904	1588	dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe	ctxmon.exe

C:\Users\Admin\AppData\Local\Temp\dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe
"C:\Users\Admin\AppData\Local\Temp\dc2d1bc3a3e6b136d50131df6d37d7c0eb9cf7aea2bb72cb3e5749050b249922.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
memory/904-56-0x0000000000000000-mapping.dmp

Download
memory/1588-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1588-60-0x0000000001000000-0x0000000001032000-memory.dmp

Filesize
200KB

Download
memory/1588-61-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download
memory/1588-62-0x0000000001000000-0x0000000001032000-memory.dmp

Filesize
200KB

Download
memory/1588-63-0x0000000000220000-0x0000000000255000-memory.dmp

Filesize
212KB

Download