Analysis
-
max time kernel
146s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 13:42
Behavioral task
behavioral1
Sample
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe
Resource
win10v2004-20220812-en
General
-
Target
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe
-
Size
32KB
-
MD5
461caa595d898e273656853c337d81c4
-
SHA1
3ad2dfade3fce9aaac15be62f8915e97e7d9b5bb
-
SHA256
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24
-
SHA512
12d44b86edd8bae7d57a395a781ddc7987a80a1b382d7954907282dba1acdb9dd47333aa84786d970effbf4b755c7ec8a51f9e64d30de8934c60453dba47c8a7
-
SSDEEP
768:cmR1BFbVRYbxdzbQuihXmixjBgdI5xPAe:VFOzbQuiIQju2rAe
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RegisteredApplications = "C:\\Users\\Admin\\AppData\\Roaming\\DA5FD1\\DA5FD1.exe" svchost.exe -
Processes:
resource yara_rule behavioral2/memory/3804-133-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/memory/3804-137-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exedescription pid process target process PID 3804 set thread context of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exepid process 1952 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe 1952 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exepid process 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.execabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exedescription pid process target process PID 3804 wrote to memory of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe PID 3804 wrote to memory of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe PID 3804 wrote to memory of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe PID 3804 wrote to memory of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe PID 3804 wrote to memory of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe PID 3804 wrote to memory of 1952 3804 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe PID 1952 wrote to memory of 3148 1952 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe svchost.exe PID 1952 wrote to memory of 3148 1952 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe svchost.exe PID 1952 wrote to memory of 3148 1952 cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe"C:\Users\Admin\AppData\Local\Temp\cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe"C:\Users\Admin\AppData\Local\Temp\cabbc8506ce5342b40aac8b08e5ca0f5b97c792b2e4af6ed2e6aae6c9c93ef24.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Adds policy Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1952-135-0x0000000000000000-mapping.dmp
-
memory/1952-136-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1952-138-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1952-140-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/3148-139-0x0000000000000000-mapping.dmp
-
memory/3148-141-0x0000000000330000-0x000000000033E000-memory.dmpFilesize
56KB
-
memory/3148-142-0x0000000001260000-0x0000000001266000-memory.dmpFilesize
24KB
-
memory/3148-143-0x00000000013D0000-0x00000000013E8000-memory.dmpFilesize
96KB
-
memory/3148-144-0x00000000013D0000-0x00000000013E8000-memory.dmpFilesize
96KB
-
memory/3804-133-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3804-137-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB