Analysis
-
max time kernel
146s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 02:14
Static task
static1
Behavioral task
behavioral1
Sample
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe
Resource
win10v2004-20220812-en
General
-
Target
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe
-
Size
226KB
-
MD5
cb3d410e74c8ed0c8ac007a5747b678a
-
SHA1
601294ff8a25d831296730de135ce2fe588736ba
-
SHA256
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
-
SHA512
1c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
SSDEEP
6144:JYa2oQoC72vdWAMNZxOdxey8KODF8IvXgV3nhm:JYWRC7EdWAMzQbg8d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
localcds.exelocalcds.exepid process 1116 localcds.exe 528 localcds.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 1692 netsh.exe 1636 netsh.exe 340 netsh.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
localcds.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run localcds.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\localcds.exe" localcds.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exelocalcds.exedescription pid process target process PID 1812 set thread context of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1116 set thread context of 528 1116 localcds.exe localcds.exe -
Drops file in Windows directory 2 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exedescription ioc process File created C:\Windows\localcds.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe File opened for modification C:\Windows\localcds.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exelocalcds.exedescription pid process Token: SeDebugPrivilege 1648 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe Token: SeDebugPrivilege 1648 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe Token: SeDebugPrivilege 528 localcds.exe Token: SeDebugPrivilege 528 localcds.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exelocalcds.exelocalcds.exedescription pid process target process PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1812 wrote to memory of 1648 1812 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 1648 wrote to memory of 1116 1648 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 1648 wrote to memory of 1116 1648 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 1648 wrote to memory of 1116 1648 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 1648 wrote to memory of 1116 1648 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 1116 wrote to memory of 528 1116 localcds.exe localcds.exe PID 528 wrote to memory of 1692 528 localcds.exe netsh.exe PID 528 wrote to memory of 1692 528 localcds.exe netsh.exe PID 528 wrote to memory of 1692 528 localcds.exe netsh.exe PID 528 wrote to memory of 1692 528 localcds.exe netsh.exe PID 528 wrote to memory of 1636 528 localcds.exe netsh.exe PID 528 wrote to memory of 1636 528 localcds.exe netsh.exe PID 528 wrote to memory of 1636 528 localcds.exe netsh.exe PID 528 wrote to memory of 1636 528 localcds.exe netsh.exe PID 528 wrote to memory of 340 528 localcds.exe netsh.exe PID 528 wrote to memory of 340 528 localcds.exe netsh.exe PID 528 wrote to memory of 340 528 localcds.exe netsh.exe PID 528 wrote to memory of 340 528 localcds.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe"C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exeC:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\localcds.exe"C:\Windows\localcds.exe" "C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\localcds.exeC:\Windows\localcds.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule profile=any name=Win2y25⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="C:\Windows\localcds.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Windows\localcds.exe"5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
memory/340-98-0x0000000000000000-mapping.dmp
-
memory/528-94-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/528-90-0x00000000131596AC-mapping.dmp
-
memory/1116-73-0x0000000000000000-mapping.dmp
-
memory/1116-95-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1636-97-0x0000000000000000-mapping.dmp
-
memory/1648-63-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-64-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-69-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-56-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-72-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-67-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-66-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-68-0x00000000131596AC-mapping.dmp
-
memory/1648-77-0x0000000013141000-0x000000001315A000-memory.dmpFilesize
100KB
-
memory/1648-57-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-61-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1648-59-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/1692-96-0x0000000000000000-mapping.dmp
-
memory/1812-54-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB
-
memory/1812-71-0x00000000744B0000-0x0000000074A5B000-memory.dmpFilesize
5.7MB
-
memory/1812-55-0x00000000744B0000-0x0000000074A5B000-memory.dmpFilesize
5.7MB