Analysis
-
max time kernel
194s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
Resource
win10v2004-20221111-en
General
-
Target
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe
-
Size
1018KB
-
MD5
edd15ba0e56002466371b1bc2f240c19
-
SHA1
ad7966d8ebc750c740921e621541c1c7434d1c9a
-
SHA256
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d
-
SHA512
17f1c8f4632bcf29586cc80a1c4e406ed1548e2061451214de823f4aa7b0c7d1839b5430a84cd2d30a3fbcc0c68e5fdee526da7d682bede8929488fefe85579a
-
SSDEEP
6144:do3pwmXC25RIyX4db7SvNJnxPGpvSiyS:ddmy2X4d
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
qxihashwvk.exepid process 1908 qxihashwvk.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MonroeResTimes = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Damp\\qxihashwvk.exe rimw" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exepid process 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.execmd.exe5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.execmd.execmd.exedescription pid process target process PID 1544 wrote to memory of 1092 1544 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 1544 wrote to memory of 1092 1544 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 1092 wrote to memory of 3628 1092 cmd.exe PING.EXE PID 1092 wrote to memory of 3628 1092 cmd.exe PING.EXE PID 1092 wrote to memory of 3012 1092 cmd.exe 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe PID 1092 wrote to memory of 3012 1092 cmd.exe 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe PID 3012 wrote to memory of 5020 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 3012 wrote to memory of 5020 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 3012 wrote to memory of 5116 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 3012 wrote to memory of 5116 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 3012 wrote to memory of 4996 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 3012 wrote to memory of 4996 3012 5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe cmd.exe PID 4996 wrote to memory of 1952 4996 cmd.exe PING.EXE PID 4996 wrote to memory of 1952 4996 cmd.exe PING.EXE PID 5116 wrote to memory of 2688 5116 cmd.exe reg.exe PID 5116 wrote to memory of 2688 5116 cmd.exe reg.exe PID 4996 wrote to memory of 1908 4996 cmd.exe qxihashwvk.exe PID 4996 wrote to memory of 1908 4996 cmd.exe qxihashwvk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe"C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SYSTEM32\cmd.execmd /c ping 127.0.0.1 -n 8 & start "" "C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe" his & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 83⤵
- Runs ping.exe
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe"C:\Users\Admin\AppData\Local\Temp\5e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d.exe" his3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c echo %temp%4⤵PID:5020
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v MonroeResTimes /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exe" rimw"4⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v MonroeResTimes /t REG_SZ /d ""C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exe" rimw"5⤵
- Adds Run key to start application
- Modifies registry key
PID:2688 -
C:\Windows\SYSTEM32\cmd.execmd /c ping 127.0.0.1 -n 8 & start "" "C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exe" mw & exit4⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 85⤵
- Runs ping.exe
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exe"C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exe" mw5⤵
- Executes dropped EXE
PID:1908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exeFilesize
1018KB
MD5edd15ba0e56002466371b1bc2f240c19
SHA1ad7966d8ebc750c740921e621541c1c7434d1c9a
SHA2565e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d
SHA51217f1c8f4632bcf29586cc80a1c4e406ed1548e2061451214de823f4aa7b0c7d1839b5430a84cd2d30a3fbcc0c68e5fdee526da7d682bede8929488fefe85579a
-
C:\Users\Admin\AppData\Local\Temp\Damp\qxihashwvk.exeFilesize
1018KB
MD5edd15ba0e56002466371b1bc2f240c19
SHA1ad7966d8ebc750c740921e621541c1c7434d1c9a
SHA2565e5ac5d5da60e796a2213bedee2b79dcff91272617b533c8fec711c56ebfb17d
SHA51217f1c8f4632bcf29586cc80a1c4e406ed1548e2061451214de823f4aa7b0c7d1839b5430a84cd2d30a3fbcc0c68e5fdee526da7d682bede8929488fefe85579a
-
memory/1092-132-0x0000000000000000-mapping.dmp
-
memory/1908-140-0x0000000000000000-mapping.dmp
-
memory/1952-138-0x0000000000000000-mapping.dmp
-
memory/2688-139-0x0000000000000000-mapping.dmp
-
memory/3012-134-0x0000000000000000-mapping.dmp
-
memory/3628-133-0x0000000000000000-mapping.dmp
-
memory/4996-137-0x0000000000000000-mapping.dmp
-
memory/5020-135-0x0000000000000000-mapping.dmp
-
memory/5116-136-0x0000000000000000-mapping.dmp