Analysis
-
max time kernel
133s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:53
Static task
static1
Behavioral task
behavioral1
Sample
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe
Resource
win10v2004-20220812-en
General
-
Target
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe
-
Size
372KB
-
MD5
c6ab3e8decce83801e62b4cd27edba9e
-
SHA1
498cdd9a4ca6c6f4e50a5b89240edd686e0a673b
-
SHA256
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e
-
SHA512
c44a570da67955c1a854bc74c8e101e172981ea37d78655885eec2326ead862d187a4e42b080d706bd06cb8c00b69cb3c4e4ac36c4ade09b445dec2cc878d170
-
SSDEEP
6144:gWWz1uvPT+Ws6R8KqtnPW/W7OGgEpdCsD5nsmkn5tsz19zMK+TVDkhPAGCNyHe:g9zkbjsXvtnPW+dg855smkn5ts59zMK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CnlhOKBFHelRtMm.exepid process 1796 CnlhOKBFHelRtMm.exe -
Deletes itself 1 IoCs
Processes:
CnlhOKBFHelRtMm.exepid process 1796 CnlhOKBFHelRtMm.exe -
Drops file in System32 directory 2 IoCs
Processes:
description ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\2ete64.vas File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\2ete64.vas -
Drops file in Windows directory 1 IoCs
Processes:
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exedescription ioc process File created C:\Windows\CnlhOKBFHelRtMm.exe e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exeCnlhOKBFHelRtMm.exepid process 2000 e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe 1796 CnlhOKBFHelRtMm.exe 1796 CnlhOKBFHelRtMm.exe 1796 CnlhOKBFHelRtMm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
CnlhOKBFHelRtMm.exepid process 1796 CnlhOKBFHelRtMm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exeCnlhOKBFHelRtMm.exedescription pid process Token: SeDebugPrivilege 2000 e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe Token: SeDebugPrivilege 1796 CnlhOKBFHelRtMm.exe Token: SeDebugPrivilege 600 -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exedescription pid process target process PID 2000 wrote to memory of 1796 2000 e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe CnlhOKBFHelRtMm.exe PID 2000 wrote to memory of 1796 2000 e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe CnlhOKBFHelRtMm.exe PID 2000 wrote to memory of 1796 2000 e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe CnlhOKBFHelRtMm.exe PID 2000 wrote to memory of 1796 2000 e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe CnlhOKBFHelRtMm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe"C:\Users\Admin\AppData\Local\Temp\e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\CnlhOKBFHelRtMm.exeC:\Users\Admin\AppData\Local\Temp\e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e.exe2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\CnlhOKBFHelRtMm.exeFilesize
372KB
MD5c6ab3e8decce83801e62b4cd27edba9e
SHA1498cdd9a4ca6c6f4e50a5b89240edd686e0a673b
SHA256e622165df7e262dcd7059d1102cec2ce5aee00636f946f6ca5659fec2071983e
SHA512c44a570da67955c1a854bc74c8e101e172981ea37d78655885eec2326ead862d187a4e42b080d706bd06cb8c00b69cb3c4e4ac36c4ade09b445dec2cc878d170
-
memory/600-62-0x0000000000620000-0x0000000000652000-memory.dmpFilesize
200KB
-
memory/600-63-0x0000000000660000-0x0000000000696000-memory.dmpFilesize
216KB
-
memory/600-64-0x0000000000660000-0x0000000000696000-memory.dmpFilesize
216KB
-
memory/1796-57-0x0000000000000000-mapping.dmp
-
memory/2000-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/2000-55-0x0000000000401000-0x0000000000403000-memory.dmpFilesize
8KB
-
memory/2000-56-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB