Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 02:14
Static task
static1
Behavioral task
behavioral1
Sample
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe
Resource
win10v2004-20220812-en
General
-
Target
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe
-
Size
226KB
-
MD5
cb3d410e74c8ed0c8ac007a5747b678a
-
SHA1
601294ff8a25d831296730de135ce2fe588736ba
-
SHA256
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
-
SHA512
1c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
SSDEEP
6144:JYa2oQoC72vdWAMNZxOdxey8KODF8IvXgV3nhm:JYWRC7EdWAMzQbg8d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
localcds.exelocalcds.exepid process 4840 localcds.exe 4888 localcds.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 4384 netsh.exe 4600 netsh.exe 4404 netsh.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
localcds.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run localcds.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\localcds.exe" localcds.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exelocalcds.exedescription pid process target process PID 4580 set thread context of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4840 set thread context of 4888 4840 localcds.exe localcds.exe -
Drops file in Windows directory 2 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exedescription ioc process File created C:\Windows\localcds.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe File opened for modification C:\Windows\localcds.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exelocalcds.exedescription pid process Token: SeDebugPrivilege 4332 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe Token: SeDebugPrivilege 4332 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe Token: SeDebugPrivilege 4888 localcds.exe Token: SeDebugPrivilege 4888 localcds.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exelocalcds.exelocalcds.exedescription pid process target process PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4580 wrote to memory of 4332 4580 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe PID 4332 wrote to memory of 4840 4332 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 4332 wrote to memory of 4840 4332 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 4332 wrote to memory of 4840 4332 337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4840 wrote to memory of 4888 4840 localcds.exe localcds.exe PID 4888 wrote to memory of 4600 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4600 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4600 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4404 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4404 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4404 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4384 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4384 4888 localcds.exe netsh.exe PID 4888 wrote to memory of 4384 4888 localcds.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe"C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exeC:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\localcds.exe"C:\Windows\localcds.exe" "C:\Users\Admin\AppData\Local\Temp\337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\localcds.exeC:\Windows\localcds.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule profile=any name=Win2y25⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="C:\Windows\localcds.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Windows\localcds.exe"5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
memory/4332-133-0x0000000000000000-mapping.dmp
-
memory/4332-134-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/4332-135-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/4332-136-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/4384-150-0x0000000000000000-mapping.dmp
-
memory/4404-149-0x0000000000000000-mapping.dmp
-
memory/4580-137-0x0000000074E20000-0x00000000753D1000-memory.dmpFilesize
5.7MB
-
memory/4580-132-0x0000000074E20000-0x00000000753D1000-memory.dmpFilesize
5.7MB
-
memory/4600-148-0x0000000000000000-mapping.dmp
-
memory/4840-141-0x00000000749E0000-0x0000000074F91000-memory.dmpFilesize
5.7MB
-
memory/4840-147-0x00000000749E0000-0x0000000074F91000-memory.dmpFilesize
5.7MB
-
memory/4840-138-0x0000000000000000-mapping.dmp
-
memory/4888-142-0x0000000000000000-mapping.dmp
-
memory/4888-146-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB