Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:35
Static task
static1
Behavioral task
behavioral1
Sample
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe
Resource
win10v2004-20221111-en
General
-
Target
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe
-
Size
480KB
-
MD5
72ee7d175b2a9b4748bb1f332ae8b407
-
SHA1
e477094547dccaf6bab7b6edbff680acb2cd7203
-
SHA256
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7
-
SHA512
dce008173b88f7dd090d2f09e4007fe0345b56740dd333f627fb8612ebc7f0476306fa73136410d6623ca177e6922951b0b0bf60f6ebdb43549359e676d788cf
-
SSDEEP
12288:GKVzzv6+WPUQ0gP2xhahj+P4qGuUuUDlzdMMMMMMMMMMMMMMMMMMTB:4+WPTnemoP4qGvu6zdMMMMMMMMMMMMMw
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
duir.exeduir.exepid process 1332 duir.exe 1796 duir.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1184 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exepid process 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
duir.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\Currentversion\Run duir.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\{38703C97-2AC3-6285-8C89-F4385A4B4314} = "C:\\Users\\Admin\\AppData\\Roaming\\Rauze\\duir.exe" duir.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exeduir.exedescription pid process target process PID 1612 set thread context of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1332 set thread context of 1796 1332 duir.exe duir.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exeduir.exeduir.exepid process 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1332 duir.exe 1332 duir.exe 1332 duir.exe 1332 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe 1796 duir.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exedescription pid process Token: SeSecurityPrivilege 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exeduir.exepid process 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe 1332 duir.exe 1332 duir.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.execmd.exenet.exec4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exeduir.execmd.exeduir.exenet.exedescription pid process target process PID 1612 wrote to memory of 1812 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1612 wrote to memory of 1812 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1612 wrote to memory of 1812 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1612 wrote to memory of 1812 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1612 wrote to memory of 1708 1612 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe PID 1812 wrote to memory of 1688 1812 cmd.exe net.exe PID 1812 wrote to memory of 1688 1812 cmd.exe net.exe PID 1812 wrote to memory of 1688 1812 cmd.exe net.exe PID 1812 wrote to memory of 1688 1812 cmd.exe net.exe PID 1688 wrote to memory of 1256 1688 net.exe net1.exe PID 1688 wrote to memory of 1256 1688 net.exe net1.exe PID 1688 wrote to memory of 1256 1688 net.exe net1.exe PID 1688 wrote to memory of 1256 1688 net.exe net1.exe PID 1708 wrote to memory of 1332 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe duir.exe PID 1708 wrote to memory of 1332 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe duir.exe PID 1708 wrote to memory of 1332 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe duir.exe PID 1708 wrote to memory of 1332 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe duir.exe PID 1332 wrote to memory of 1720 1332 duir.exe cmd.exe PID 1332 wrote to memory of 1720 1332 duir.exe cmd.exe PID 1332 wrote to memory of 1720 1332 duir.exe cmd.exe PID 1332 wrote to memory of 1720 1332 duir.exe cmd.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1332 wrote to memory of 1796 1332 duir.exe duir.exe PID 1708 wrote to memory of 1184 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1708 wrote to memory of 1184 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1708 wrote to memory of 1184 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1708 wrote to memory of 1184 1708 c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe cmd.exe PID 1720 wrote to memory of 1604 1720 cmd.exe net.exe PID 1720 wrote to memory of 1604 1720 cmd.exe net.exe PID 1720 wrote to memory of 1604 1720 cmd.exe net.exe PID 1720 wrote to memory of 1604 1720 cmd.exe net.exe PID 1796 wrote to memory of 1240 1796 duir.exe taskhost.exe PID 1796 wrote to memory of 1240 1796 duir.exe taskhost.exe PID 1796 wrote to memory of 1240 1796 duir.exe taskhost.exe PID 1796 wrote to memory of 1240 1796 duir.exe taskhost.exe PID 1796 wrote to memory of 1240 1796 duir.exe taskhost.exe PID 1604 wrote to memory of 928 1604 net.exe net1.exe PID 1604 wrote to memory of 928 1604 net.exe net1.exe PID 1604 wrote to memory of 928 1604 net.exe net1.exe PID 1604 wrote to memory of 928 1604 net.exe net1.exe PID 1796 wrote to memory of 1320 1796 duir.exe Dwm.exe PID 1796 wrote to memory of 1320 1796 duir.exe Dwm.exe PID 1796 wrote to memory of 1320 1796 duir.exe Dwm.exe PID 1796 wrote to memory of 1320 1796 duir.exe Dwm.exe PID 1796 wrote to memory of 1320 1796 duir.exe Dwm.exe PID 1796 wrote to memory of 1356 1796 duir.exe Explorer.EXE PID 1796 wrote to memory of 1356 1796 duir.exe Explorer.EXE PID 1796 wrote to memory of 1356 1796 duir.exe Explorer.EXE PID 1796 wrote to memory of 1356 1796 duir.exe Explorer.EXE
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1320
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe"C:\Users\Admin\AppData\Local\Temp\c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc4⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc5⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exeC:\Users\Admin\AppData\Local\Temp\c4a6e2a61bb65a5893284ad5fc8e96fde3d189f89edc1ea75799329b556c28b7.exe3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Roaming\Rauze\duir.exe"C:\Users\Admin\AppData\Roaming\Rauze\duir.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc5⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc6⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc7⤵PID:928
-
C:\Users\Admin\AppData\Roaming\Rauze\duir.exeC:\Users\Admin\AppData\Roaming\Rauze\duir.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0c777847.bat"4⤵
- Deletes itself
PID:1184
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1240
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1664
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:268
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp0c777847.batFilesize
307B
MD5a532f3fb10eaeb1d74ecba8aae764f48
SHA183064fa18bda87d132f4956dd74e4773eae3ec48
SHA25612d04653554daa7fefa7c1824cd24aab2f048b0316b9da306955ff9d8a01e239
SHA51245f2708847bc29737a9f7bcfbd809af2fc166071926ea33daab1423b24df1442ae953866608a22f2b6b968ceed28e861e55cbd6458fd8ff3f9e531dd9e1e2904
-
C:\Users\Admin\AppData\Roaming\Rauze\duir.exeFilesize
480KB
MD5720e21a20f6a21073d4a8ac632b9e2f7
SHA1c1c9c5889c187ebf973a258bc07a99cc01877524
SHA256e5ce836c71d24c92e1d5de805ee75c441ae60b4b2b797e4d1d950e94331828be
SHA512ae78770b2750513ae49a1cddbde9320cd354687e9be767ad4fca57172416e883948b1cf034d6656f987cf8931355b4f7f980f06217c34d2fbea4b089a1c859c2
-
C:\Users\Admin\AppData\Roaming\Rauze\duir.exeFilesize
480KB
MD5720e21a20f6a21073d4a8ac632b9e2f7
SHA1c1c9c5889c187ebf973a258bc07a99cc01877524
SHA256e5ce836c71d24c92e1d5de805ee75c441ae60b4b2b797e4d1d950e94331828be
SHA512ae78770b2750513ae49a1cddbde9320cd354687e9be767ad4fca57172416e883948b1cf034d6656f987cf8931355b4f7f980f06217c34d2fbea4b089a1c859c2
-
C:\Users\Admin\AppData\Roaming\Rauze\duir.exeFilesize
480KB
MD5720e21a20f6a21073d4a8ac632b9e2f7
SHA1c1c9c5889c187ebf973a258bc07a99cc01877524
SHA256e5ce836c71d24c92e1d5de805ee75c441ae60b4b2b797e4d1d950e94331828be
SHA512ae78770b2750513ae49a1cddbde9320cd354687e9be767ad4fca57172416e883948b1cf034d6656f987cf8931355b4f7f980f06217c34d2fbea4b089a1c859c2
-
\Users\Admin\AppData\Roaming\Rauze\duir.exeFilesize
480KB
MD5720e21a20f6a21073d4a8ac632b9e2f7
SHA1c1c9c5889c187ebf973a258bc07a99cc01877524
SHA256e5ce836c71d24c92e1d5de805ee75c441ae60b4b2b797e4d1d950e94331828be
SHA512ae78770b2750513ae49a1cddbde9320cd354687e9be767ad4fca57172416e883948b1cf034d6656f987cf8931355b4f7f980f06217c34d2fbea4b089a1c859c2
-
\Users\Admin\AppData\Roaming\Rauze\duir.exeFilesize
480KB
MD5720e21a20f6a21073d4a8ac632b9e2f7
SHA1c1c9c5889c187ebf973a258bc07a99cc01877524
SHA256e5ce836c71d24c92e1d5de805ee75c441ae60b4b2b797e4d1d950e94331828be
SHA512ae78770b2750513ae49a1cddbde9320cd354687e9be767ad4fca57172416e883948b1cf034d6656f987cf8931355b4f7f980f06217c34d2fbea4b089a1c859c2
-
memory/268-124-0x0000000003B50000-0x0000000003B77000-memory.dmpFilesize
156KB
-
memory/268-123-0x0000000003B50000-0x0000000003B77000-memory.dmpFilesize
156KB
-
memory/268-122-0x0000000003B50000-0x0000000003B77000-memory.dmpFilesize
156KB
-
memory/268-121-0x0000000003B50000-0x0000000003B77000-memory.dmpFilesize
156KB
-
memory/928-101-0x0000000000000000-mapping.dmp
-
memory/1184-89-0x0000000000000000-mapping.dmp
-
memory/1240-98-0x0000000001BD0000-0x0000000001BF7000-memory.dmpFilesize
156KB
-
memory/1240-97-0x0000000001BD0000-0x0000000001BF7000-memory.dmpFilesize
156KB
-
memory/1240-95-0x0000000001BD0000-0x0000000001BF7000-memory.dmpFilesize
156KB
-
memory/1240-96-0x0000000001BD0000-0x0000000001BF7000-memory.dmpFilesize
156KB
-
memory/1256-68-0x0000000000000000-mapping.dmp
-
memory/1320-105-0x0000000000130000-0x0000000000157000-memory.dmpFilesize
156KB
-
memory/1320-104-0x0000000000130000-0x0000000000157000-memory.dmpFilesize
156KB
-
memory/1320-103-0x0000000000130000-0x0000000000157000-memory.dmpFilesize
156KB
-
memory/1320-102-0x0000000000130000-0x0000000000157000-memory.dmpFilesize
156KB
-
memory/1332-73-0x0000000000000000-mapping.dmp
-
memory/1356-111-0x00000000025A0000-0x00000000025C7000-memory.dmpFilesize
156KB
-
memory/1356-109-0x00000000025A0000-0x00000000025C7000-memory.dmpFilesize
156KB
-
memory/1356-108-0x00000000025A0000-0x00000000025C7000-memory.dmpFilesize
156KB
-
memory/1356-110-0x00000000025A0000-0x00000000025C7000-memory.dmpFilesize
156KB
-
memory/1604-92-0x0000000000000000-mapping.dmp
-
memory/1612-64-0x0000000000320000-0x0000000000324000-memory.dmpFilesize
16KB
-
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1664-116-0x0000000000410000-0x0000000000437000-memory.dmpFilesize
156KB
-
memory/1664-117-0x0000000000410000-0x0000000000437000-memory.dmpFilesize
156KB
-
memory/1664-118-0x0000000000410000-0x0000000000437000-memory.dmpFilesize
156KB
-
memory/1664-115-0x0000000000410000-0x0000000000437000-memory.dmpFilesize
156KB
-
memory/1688-67-0x0000000000000000-mapping.dmp
-
memory/1708-69-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-90-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-70-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-63-0x0000000000413048-mapping.dmp
-
memory/1708-62-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-60-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-59-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-57-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1708-56-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1720-77-0x0000000000000000-mapping.dmp
-
memory/1796-85-0x0000000000413048-mapping.dmp
-
memory/1796-112-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1812-55-0x0000000000000000-mapping.dmp