9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a

Analysis

max time kernel
151s
max time network
186s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe
Size 325KB
Sample221126-2nm7vaec2x
SHA256 9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a
MD5 625f8b9af2d696bfbf15c8d3962b8c09
SHA1 4d619346ae1c72e833937d3d6e84df26e32e2e90
SHA512 9f48d760c34d3377cd11bd3e5b7d6847215d0b27767e7cfda3512ecb82747fac43e8ad02215fa6ef44c188a6c1830da8a6b9aa0c065153489353e684772c924c
SSDEEP 6144:LnqW/fLjc+4UrjDXI8tJB4qP5EtQs0uVgXX5LAvN:LqqLFh/LTPays0CA1a
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1452	sotes.exe
1448	sotes.exe

Deletes itself 1 IoCs

pid	Process
1040	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe
368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7B4F18C8-4FEF-AD4D-3A07-B8B71A0C9BAA} = "C:\\Users\\Admin\\AppData\\Roaming\\Urxei\\sotes.exe"	sotes.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\Currentversion\Run	sotes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1452 set thread context of 1448	1452	sotes.exe	29

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Privacy	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe
1448	sotes.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 1928 wrote to memory of 368	1928	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	27
PID 368 wrote to memory of 1452	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	28
PID 368 wrote to memory of 1452	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	28
PID 368 wrote to memory of 1452	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	28
PID 368 wrote to memory of 1452	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	28
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1452 wrote to memory of 1448	1452	sotes.exe	29
PID 1448 wrote to memory of 1120	1448	sotes.exe	21
PID 1448 wrote to memory of 1120	1448	sotes.exe	21
PID 1448 wrote to memory of 1120	1448	sotes.exe	21
PID 1448 wrote to memory of 1120	1448	sotes.exe	21
PID 1448 wrote to memory of 1120	1448	sotes.exe	21
PID 1448 wrote to memory of 1172	1448	sotes.exe	13
PID 1448 wrote to memory of 1172	1448	sotes.exe	13
PID 1448 wrote to memory of 1172	1448	sotes.exe	13
PID 1448 wrote to memory of 1172	1448	sotes.exe	13
PID 1448 wrote to memory of 1172	1448	sotes.exe	13
PID 1448 wrote to memory of 1236	1448	sotes.exe	20
PID 1448 wrote to memory of 1236	1448	sotes.exe	20
PID 1448 wrote to memory of 1236	1448	sotes.exe	20
PID 1448 wrote to memory of 1236	1448	sotes.exe	20
PID 1448 wrote to memory of 1236	1448	sotes.exe	20
PID 1448 wrote to memory of 368	1448	sotes.exe	27
PID 1448 wrote to memory of 368	1448	sotes.exe	27
PID 1448 wrote to memory of 368	1448	sotes.exe	27
PID 1448 wrote to memory of 368	1448	sotes.exe	27
PID 1448 wrote to memory of 368	1448	sotes.exe	27
PID 368 wrote to memory of 1040	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	30
PID 368 wrote to memory of 1040	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	30
PID 368 wrote to memory of 1040	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	30
PID 368 wrote to memory of 1040	368	9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe	30

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe
"C:\Users\Admin\AppData\Local\Temp\9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe
  "C:\Users\Admin\AppData\Local\Temp\9fcb430e48bc32e8a92be15be41b891a05bfb7fdb972aee690421cae08135b7a.exe"
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe
    "C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe
      "C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd873a6b3.bat"
    3⤵
    - Deletes itself
    PID:1040

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1236

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpd873a6b3.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpd873a6b3.bat
Size 307B
SHA256 368bb835ad3e724ef039449722980ff8bfe1e477cef419b44e306ad165768474
MD5 ef455830e71250168df1c44500d27c66
SHA1 ef2c44a091d38d5271eab8295ecb0163340e0a7f
SHA512 c9bda5d4feb73046ea5e4b9d517736003a6928860e2230f28c6094e272c553af76a2b77cbf46d735e9107ffa6dcb5805b13d2957792fd29671587a4a4d7acc4c
MD5 SHA1 SHA512

Submit Download

sotes.exe

Path C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe
Size 325KB
SHA256 fcaed24e1f6d9bf5b6bfe9b0da6236c0f95e19424359a92d1bb4e2b2ed2e668b
MD5 58f35bdb544ccefa1f29b17260daa6b3
SHA1 99f0c396f50774579ea2925109d3c3f378333f8e
SHA512 a7e3178ae173e2a6343d2d245afef2f5403fc5e0423260e8f9a643da274807e7d72539a62d3956c00b3c159a032304eb696aeeac8c09b1dc713d0f00aa4e2834
SSDEEP 6144:LnqW/fLjc+4UrjDXI8tJB4qP5EtQs0uVgXX5LAvX:LqqLFh/LTPays0CA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sotes.exe

Path C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe
Size 325KB
SHA256 fcaed24e1f6d9bf5b6bfe9b0da6236c0f95e19424359a92d1bb4e2b2ed2e668b
MD5 58f35bdb544ccefa1f29b17260daa6b3
SHA1 99f0c396f50774579ea2925109d3c3f378333f8e
SHA512 a7e3178ae173e2a6343d2d245afef2f5403fc5e0423260e8f9a643da274807e7d72539a62d3956c00b3c159a032304eb696aeeac8c09b1dc713d0f00aa4e2834
SSDEEP 6144:LnqW/fLjc+4UrjDXI8tJB4qP5EtQs0uVgXX5LAvX:LqqLFh/LTPays0CA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sotes.exe

Path C:\Users\Admin\AppData\Roaming\Urxei\sotes.exe
Size 325KB
SHA256 fcaed24e1f6d9bf5b6bfe9b0da6236c0f95e19424359a92d1bb4e2b2ed2e668b
MD5 58f35bdb544ccefa1f29b17260daa6b3
SHA1 99f0c396f50774579ea2925109d3c3f378333f8e
SHA512 a7e3178ae173e2a6343d2d245afef2f5403fc5e0423260e8f9a643da274807e7d72539a62d3956c00b3c159a032304eb696aeeac8c09b1dc713d0f00aa4e2834
SSDEEP 6144:LnqW/fLjc+4UrjDXI8tJB4qP5EtQs0uVgXX5LAvX:LqqLFh/LTPays0CA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sotes.exe

Path \Users\Admin\AppData\Roaming\Urxei\sotes.exe
Size 325KB
SHA256 fcaed24e1f6d9bf5b6bfe9b0da6236c0f95e19424359a92d1bb4e2b2ed2e668b
MD5 58f35bdb544ccefa1f29b17260daa6b3
SHA1 99f0c396f50774579ea2925109d3c3f378333f8e
SHA512 a7e3178ae173e2a6343d2d245afef2f5403fc5e0423260e8f9a643da274807e7d72539a62d3956c00b3c159a032304eb696aeeac8c09b1dc713d0f00aa4e2834
SSDEEP 6144:LnqW/fLjc+4UrjDXI8tJB4qP5EtQs0uVgXX5LAvX:LqqLFh/LTPays0CA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

sotes.exe

Path \Users\Admin\AppData\Roaming\Urxei\sotes.exe
Size 325KB
SHA256 fcaed24e1f6d9bf5b6bfe9b0da6236c0f95e19424359a92d1bb4e2b2ed2e668b
MD5 58f35bdb544ccefa1f29b17260daa6b3
SHA1 99f0c396f50774579ea2925109d3c3f378333f8e
SHA512 a7e3178ae173e2a6343d2d245afef2f5403fc5e0423260e8f9a643da274807e7d72539a62d3956c00b3c159a032304eb696aeeac8c09b1dc713d0f00aa4e2834
SSDEEP 6144:LnqW/fLjc+4UrjDXI8tJB4qP5EtQs0uVgXX5LAvX:LqqLFh/LTPays0CA1w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-55-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-113-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-65-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Download

memory/368-61-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-114-0x0000000000450000-0x0000000000494000-memory.dmp

Download

memory/368-56-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-70-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-59-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-58-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/368-107-0x0000000000450000-0x0000000000494000-memory.dmp

Download

memory/368-72-0x0000000000450000-0x00000000004A6000-memory.dmp

Download

memory/368-106-0x0000000000450000-0x0000000000494000-memory.dmp

Download

memory/368-71-0x0000000000450000-0x00000000004A6000-memory.dmp

Download

memory/368-111-0x0000000000450000-0x00000000004A6000-memory.dmp

Download

memory/368-109-0x0000000000450000-0x0000000000494000-memory.dmp

Download

memory/368-108-0x0000000000450000-0x0000000000494000-memory.dmp

Download

memory/1120-88-0x00000000004B0000-0x00000000004F4000-memory.dmp

Download

memory/1120-89-0x00000000004B0000-0x00000000004F4000-memory.dmp

Download

memory/1120-90-0x00000000004B0000-0x00000000004F4000-memory.dmp

Download

memory/1120-91-0x00000000004B0000-0x00000000004F4000-memory.dmp

Download

memory/1172-94-0x0000000000120000-0x0000000000164000-memory.dmp

Download

memory/1172-96-0x0000000000120000-0x0000000000164000-memory.dmp

Download

memory/1172-97-0x0000000000120000-0x0000000000164000-memory.dmp

Download

memory/1172-95-0x0000000000120000-0x0000000000164000-memory.dmp

Download

memory/1236-101-0x0000000002120000-0x0000000002164000-memory.dmp

Download

memory/1236-103-0x0000000002120000-0x0000000002164000-memory.dmp

Download

memory/1236-102-0x0000000002120000-0x0000000002164000-memory.dmp

Download

memory/1236-100-0x0000000002120000-0x0000000002164000-memory.dmp

Download

memory/1448-110-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1448-116-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1452-84-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1928-54-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/1928-63-0x0000000000400000-0x0000000000456000-memory.dmp

Download