3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca

Analysis

max time kernel
13s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe
Size

538KB
MD5

1dbff3a9c709bcd8e87f16d19d068534
SHA1

1e21532245989e09066fe3c07914b7c2746834f7
SHA256

3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca
SHA512

7e3c5dde892a67277613bb76299d545bdd03828177098dacb6ebbfe74ea25815bf030d19bf56d44c17ac90b329f1c5fb767cd1810d1c033524e1de79cbc08223
SSDEEP

12288:sBy4GROO333gu/u2edcjd8FP+yItrc6lq:sg4nO3ngu2lHFP+yAlq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

pid process

4556 3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

pid	process
4556	3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DewluKutgi = "regsvr32.exe \"C:\\ProgramData\\DewluKutgi\\DewluKutgi.dat\""	3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

Modifies registry class 2 IoCs

Processes:

3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{0EC92C75-75FB-40FC-BBB4-010D766D1434}	3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{0EC92C75-75FB-40FC-BBB4-010D766D1434}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c336165363037663636656637623632303530306665303064636365346538616565653833313464333136653939663335356362356432303961613431303963612e65786500	3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe

C:\Users\Admin\AppData\Local\Temp\3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe
"C:\Users\Admin\AppData\Local\Temp\3ae607f66ef7b620500fe00dcce4e8aeee8314d316e99f355cb5d209aa4109ca.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:4556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DewluKutgi\DewluKutgi.dat
Filesize
264KB

MD5
d9a38389ef1199cf9c4029cabb078d68

SHA1
2dcd969a875efaa6ccb43fae478c2fdfd12f89b9

SHA256
f7ff7330114c516ee22e874734652f420d9dc3c33d249435052ec84b771091e6

SHA512
6b5715bbc8e1f8027a303c8fdc3b5c00e42f9984a6ea2ecd056bece9ac323f24de77758d14f6ced2486315c251d8414a1036a005f52d6a43ae8c3766faf6f2b2

Download Submit
memory/4556-132-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/4556-133-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4556-136-0x0000000075220000-0x0000000075253000-memory.dmp

Filesize
204KB

Download
memory/4556-138-0x0000000075220000-0x000000007528C000-memory.dmp

Filesize
432KB

Download