7ebfc698cf187fbd5bb410a51017057adfaefab87252709bb0935cdd5f7559c4

Analysis

max time kernel
91s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 01:31

Target

SecuriteInfo.com.Trojan.MulDrop21.15342.27938.8060.exe
Size

8KB
MD5

9b653ee2746d67ecc79685bd49ce177a
SHA1

da57174bde371a68b553eec64c0e079da7cceb35
SHA256

7ebfc698cf187fbd5bb410a51017057adfaefab87252709bb0935cdd5f7559c4
SHA512

be71c69c7c8adf1ce8827db35d5e09aeb192dff34374039b10901bef87492bd8bd38e8497b59c0d0da971e5ca54d36925198b36bf40282e82f46ee2ce00fcdee
SSDEEP

96:7Z83yfYaodPyaH1EWo0UYDQGAhNdcMu4cybu8xOL3yfXYPznlVDAFRvaf2sP0M:7ZtPWyavUSAlRR3fYL3DAFxaZ

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

svcupdater.exe

pid process

1432 svcupdater.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3548 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svcupdater.exe

description pid process

Token: SeDebugPrivilege 1432 svcupdater.exe

pid	process
1432	svcupdater.exe

pid	process
3548	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	1432	svcupdater.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDrop21.15342.27938.8060.execmd.exe

description	pid	process	target process
PID 2232 wrote to memory of 208	2232	SecuriteInfo.com.Trojan.MulDrop21.15342.27938.8060.exe	cmd.exe
PID 2232 wrote to memory of 208	2232	SecuriteInfo.com.Trojan.MulDrop21.15342.27938.8060.exe	cmd.exe
PID 208 wrote to memory of 3548	208	cmd.exe	schtasks.exe
PID 208 wrote to memory of 3548	208	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop21.15342.27938.8060.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop21.15342.27938.8060.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C schtasks /create /tn \UhdYJxpVOL /tr "C:\Users\Admin\AppData\Roaming\UhdYJxpVOL\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\system32\schtasks.exe
schtasks /create /tn \UhdYJxpVOL /tr "C:\Users\Admin\AppData\Roaming\UhdYJxpVOL\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
3⤵
- Creates scheduled task(s)
PID:3548

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\Users\Admin\AppData\Roaming\UhdYJxpVOL\svcupdater.exe
Filesize
603.0MB

MD5
2a5d2bbf963a438a62c0cc41bb80d9ad

SHA1
c86f32b2590c6b5bfc113776613b3df007d36093

SHA256
6e0a352e837fe7002700b551e86a9104accca9f11830ec63582712e44ddcefbc

SHA512
ed6f844eed7957399a04fb3ebba5111266e49c035030d5676884b9e283ad4837c4dd1ee548b175f52097709184d088f16dab61b17e323a73967de817364cc583

Download Submit
C:\Users\Admin\AppData\Roaming\UhdYJxpVOL\svcupdater.exe
Filesize
603.0MB

MD5
2a5d2bbf963a438a62c0cc41bb80d9ad

SHA1
c86f32b2590c6b5bfc113776613b3df007d36093

SHA256
6e0a352e837fe7002700b551e86a9104accca9f11830ec63582712e44ddcefbc

SHA512
ed6f844eed7957399a04fb3ebba5111266e49c035030d5676884b9e283ad4837c4dd1ee548b175f52097709184d088f16dab61b17e323a73967de817364cc583

Download Submit
memory/208-134-0x0000000000000000-mapping.dmp

Download
memory/1432-139-0x00007FFBFEDB0000-0x00007FFBFF871000-memory.dmp

Filesize
10.8MB

Download
memory/1432-140-0x00007FFBFEDB0000-0x00007FFBFF871000-memory.dmp

Filesize
10.8MB

Download
memory/2232-132-0x0000000000360000-0x0000000000368000-memory.dmp

Filesize
32KB

Download
memory/2232-133-0x00007FFBFEF90000-0x00007FFBFFA51000-memory.dmp

Filesize
10.8MB

Download
memory/2232-136-0x00007FFBFEF90000-0x00007FFBFFA51000-memory.dmp

Filesize
10.8MB

Download
memory/3548-135-0x0000000000000000-mapping.dmp

Download