Analysis
-
max time kernel
152s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:33
Static task
static1
Behavioral task
behavioral1
Sample
7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe
Resource
win10v2004-20220812-en
General
-
Target
7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe
-
Size
269KB
-
MD5
58976e5821ae6701f6aabbc279951cc0
-
SHA1
9878db60426f3b0de4535afc4573c612b05cfe28
-
SHA256
7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b
-
SHA512
8c76c202e2cec464e4586cffa72bb18bd47adcbd8e2e17163287f88475368cc8b06657210c2af639a2d17b64cf623a857be5542fbf4da555e1f2f122de4c51d7
-
SSDEEP
6144:7iQ4+wpCBAiKc3yu7svlVVQWx5lkinovBfBD+D3SMHZzA:7jwcBlHL7sdl5oJpASMHZc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1340 lyyqu.exe -
Deletes itself 1 IoCs
pid Process 556 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run lyyqu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lyyqu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ezde\\lyyqu.exe" lyyqu.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1588 set thread context of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe 1340 lyyqu.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1340 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 27 PID 1588 wrote to memory of 1340 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 27 PID 1588 wrote to memory of 1340 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 27 PID 1588 wrote to memory of 1340 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 27 PID 1340 wrote to memory of 1124 1340 lyyqu.exe 13 PID 1340 wrote to memory of 1124 1340 lyyqu.exe 13 PID 1340 wrote to memory of 1124 1340 lyyqu.exe 13 PID 1340 wrote to memory of 1124 1340 lyyqu.exe 13 PID 1340 wrote to memory of 1124 1340 lyyqu.exe 13 PID 1340 wrote to memory of 1232 1340 lyyqu.exe 12 PID 1340 wrote to memory of 1232 1340 lyyqu.exe 12 PID 1340 wrote to memory of 1232 1340 lyyqu.exe 12 PID 1340 wrote to memory of 1232 1340 lyyqu.exe 12 PID 1340 wrote to memory of 1232 1340 lyyqu.exe 12 PID 1340 wrote to memory of 1288 1340 lyyqu.exe 11 PID 1340 wrote to memory of 1288 1340 lyyqu.exe 11 PID 1340 wrote to memory of 1288 1340 lyyqu.exe 11 PID 1340 wrote to memory of 1288 1340 lyyqu.exe 11 PID 1340 wrote to memory of 1288 1340 lyyqu.exe 11 PID 1340 wrote to memory of 1588 1340 lyyqu.exe 7 PID 1340 wrote to memory of 1588 1340 lyyqu.exe 7 PID 1340 wrote to memory of 1588 1340 lyyqu.exe 7 PID 1340 wrote to memory of 1588 1340 lyyqu.exe 7 PID 1340 wrote to memory of 1588 1340 lyyqu.exe 7 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1588 wrote to memory of 556 1588 7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe 28 PID 1340 wrote to memory of 1880 1340 lyyqu.exe 29 PID 1340 wrote to memory of 1880 1340 lyyqu.exe 29 PID 1340 wrote to memory of 1880 1340 lyyqu.exe 29 PID 1340 wrote to memory of 1880 1340 lyyqu.exe 29 PID 1340 wrote to memory of 1880 1340 lyyqu.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe"C:\Users\Admin\AppData\Local\Temp\7f5e4fcad117286fc9a04917aea47cfd4ccb2805803f4be07f913d399a6cb67b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\Ezde\lyyqu.exe"C:\Users\Admin\AppData\Local\Temp\Ezde\lyyqu.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1340
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JAH3F7.bat"2⤵
- Deletes itself
PID:556
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1288
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1232
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "12374672001409634653-421093261-2000258921194385841710707685382058058849-608132333"1⤵PID:1880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5b5b4c0ccd0043f2622a97b64b9cb1c91
SHA17e8dea010edb36ce485f61c5ed824f791162812a
SHA25683cd792d199d00702a09de5b075a0b3e44d82d92489524b759b35bad8d8e59a6
SHA5127376ba08c18fb819617c5c97862d02fa3c690d8d4459a743ec01acc358a9110801087ed631870d6b303de85a0354736ba7c30e564226a05281c2d2a3cc2bebf4
-
Filesize
269KB
MD5b5b4c0ccd0043f2622a97b64b9cb1c91
SHA17e8dea010edb36ce485f61c5ed824f791162812a
SHA25683cd792d199d00702a09de5b075a0b3e44d82d92489524b759b35bad8d8e59a6
SHA5127376ba08c18fb819617c5c97862d02fa3c690d8d4459a743ec01acc358a9110801087ed631870d6b303de85a0354736ba7c30e564226a05281c2d2a3cc2bebf4
-
Filesize
274B
MD5186aa31a919689b7434523183b5e5aba
SHA1b34aef9a4601ebd63161c1e0a165527b80c0b8d6
SHA256e698ab07042245dc0dce186ff0f5f2f80cb114049b4a96c34c1272a0f5e869ff
SHA5127500d420b51fb565ae3cec252686020cbd1a8d605eb8848b5a986b24c7d11cb9e97b01c70402418bf128bec672a0094ce2355c589badef64a49a906b826424cd
-
Filesize
269KB
MD5b5b4c0ccd0043f2622a97b64b9cb1c91
SHA17e8dea010edb36ce485f61c5ed824f791162812a
SHA25683cd792d199d00702a09de5b075a0b3e44d82d92489524b759b35bad8d8e59a6
SHA5127376ba08c18fb819617c5c97862d02fa3c690d8d4459a743ec01acc358a9110801087ed631870d6b303de85a0354736ba7c30e564226a05281c2d2a3cc2bebf4
-
Filesize
269KB
MD5b5b4c0ccd0043f2622a97b64b9cb1c91
SHA17e8dea010edb36ce485f61c5ed824f791162812a
SHA25683cd792d199d00702a09de5b075a0b3e44d82d92489524b759b35bad8d8e59a6
SHA5127376ba08c18fb819617c5c97862d02fa3c690d8d4459a743ec01acc358a9110801087ed631870d6b303de85a0354736ba7c30e564226a05281c2d2a3cc2bebf4