Analysis
-
max time kernel
245s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 02:14
Static task
static1
Behavioral task
behavioral1
Sample
Mondial Relay - Suivi Votre Colis.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Mondial Relay - Suivi Votre Colis.exe
Resource
win10v2004-20221111-en
General
-
Target
Mondial Relay - Suivi Votre Colis.exe
-
Size
226KB
-
MD5
cb3d410e74c8ed0c8ac007a5747b678a
-
SHA1
601294ff8a25d831296730de135ce2fe588736ba
-
SHA256
337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
-
SHA512
1c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
SSDEEP
6144:JYa2oQoC72vdWAMNZxOdxey8KODF8IvXgV3nhm:JYWRC7EdWAMzQbg8d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
localcds.exelocalcds.exepid process 3472 localcds.exe 3508 localcds.exe -
Modifies Windows Firewall 1 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 1688 netsh.exe 3288 netsh.exe 3540 netsh.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
localcds.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run localcds.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\localcds.exe" localcds.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Mondial Relay - Suivi Votre Colis.exelocalcds.exedescription pid process target process PID 1840 set thread context of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 3472 set thread context of 3508 3472 localcds.exe localcds.exe -
Drops file in Windows directory 2 IoCs
Processes:
Mondial Relay - Suivi Votre Colis.exedescription ioc process File opened for modification C:\Windows\localcds.exe Mondial Relay - Suivi Votre Colis.exe File created C:\Windows\localcds.exe Mondial Relay - Suivi Votre Colis.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Mondial Relay - Suivi Votre Colis.exelocalcds.exedescription pid process Token: SeDebugPrivilege 2644 Mondial Relay - Suivi Votre Colis.exe Token: SeDebugPrivilege 2644 Mondial Relay - Suivi Votre Colis.exe Token: SeDebugPrivilege 3508 localcds.exe Token: SeDebugPrivilege 3508 localcds.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
Mondial Relay - Suivi Votre Colis.exeMondial Relay - Suivi Votre Colis.exelocalcds.exelocalcds.exedescription pid process target process PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 1840 wrote to memory of 2644 1840 Mondial Relay - Suivi Votre Colis.exe Mondial Relay - Suivi Votre Colis.exe PID 2644 wrote to memory of 3472 2644 Mondial Relay - Suivi Votre Colis.exe localcds.exe PID 2644 wrote to memory of 3472 2644 Mondial Relay - Suivi Votre Colis.exe localcds.exe PID 2644 wrote to memory of 3472 2644 Mondial Relay - Suivi Votre Colis.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3472 wrote to memory of 3508 3472 localcds.exe localcds.exe PID 3508 wrote to memory of 1688 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 1688 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 1688 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 3540 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 3540 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 3540 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 3288 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 3288 3508 localcds.exe netsh.exe PID 3508 wrote to memory of 3288 3508 localcds.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mondial Relay - Suivi Votre Colis.exe"C:\Users\Admin\AppData\Local\Temp\Mondial Relay - Suivi Votre Colis.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mondial Relay - Suivi Votre Colis.exe"C:\Users\Admin\AppData\Local\Temp\Mondial Relay - Suivi Votre Colis.exe"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\localcds.exe"C:\Windows\localcds.exe" "C:\Users\Admin\AppData\Local\Temp\Mondial Relay - Suivi Votre Colis.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\localcds.exeC:\Windows\localcds.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall delete rule profile=any name=Win2y25⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Win2y2 program="C:\Windows\localcds.exe"5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Win2y2 program="C:\Windows\localcds.exe"5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
C:\Windows\localcds.exeFilesize
226KB
MD5cb3d410e74c8ed0c8ac007a5747b678a
SHA1601294ff8a25d831296730de135ce2fe588736ba
SHA256337b7a0119a9512632aa5349449797eff2c569382f220e279bcd595959dc82d1
SHA5121c11c657819134d9fa97e3ed387c9b74c9ed42be8d9e67d9f45ef43b988df6fee82cee076945f23e6604f20d93d2fa3b7dc296459b0f96e42523be5c7988bf2e
-
memory/1688-149-0x0000000000000000-mapping.dmp
-
memory/1840-132-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB
-
memory/1840-133-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB
-
memory/1840-141-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB
-
memory/2644-137-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/2644-134-0x0000000000000000-mapping.dmp
-
memory/2644-135-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/2644-136-0x0000000013140000-0x000000001316B000-memory.dmpFilesize
172KB
-
memory/3288-151-0x0000000000000000-mapping.dmp
-
memory/3472-138-0x0000000000000000-mapping.dmp
-
memory/3472-144-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB
-
memory/3472-148-0x00000000748D0000-0x0000000074E81000-memory.dmpFilesize
5.7MB
-
memory/3508-142-0x0000000000000000-mapping.dmp
-
memory/3540-150-0x0000000000000000-mapping.dmp