Overview

overview

8

Static

static

18a15d56f8...34.exe

windows7-x64

8

18a15d56f8...34.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2022, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    18a15d56f85fb05b07a481d2bf43ed8342f52d1f908d40d7cd0ffc93ae957934.exe

  • Size

    2.8MB

  • MD5

    1c73b5436b2573fe0f6c6a9128dafc20

  • SHA1

    de6c45ffd85ff221fe0cf9477d6ee466220d9cc1

  • SHA256

    18a15d56f85fb05b07a481d2bf43ed8342f52d1f908d40d7cd0ffc93ae957934

  • SHA512

    4f32bef4a81199448c86182bdb21f537cb0aaecc421d515e332569d3231d8c7e3e39f1afce176b551f50cb0cbb401834c2651b181e68d1a616f1e0c09f996976

  • SSDEEP

    49152:RwGOuxArlWrOh/461qBANKVK9rosF1d2p0hvyVjTrDkbJj1m6mY8NEr:R2uxd0KM9rotpqsDq4Y8

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Modifies data under HKEY_USERS 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18a15d56f85fb05b07a481d2bf43ed8342f52d1f908d40d7cd0ffc93ae957934.exe
    "C:\Users\Admin\AppData\Local\Temp\18a15d56f85fb05b07a481d2bf43ed8342f52d1f908d40d7cd0ffc93ae957934.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\StatMaker\StatMaker.dll",serv -install
      2⤵
      • Loads dropped DLL
      PID:4944
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\StatMaker\StatMaker.dll",serv
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\StatMaker\StatMaker.dll",serv
      2⤵
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      PID:384

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\StatMaker\StatMaker.dll
          Filesize

          1.9MB

          MD5

          78c8d1bc7fbb01b622ce76b7ae415f32

          SHA1

          487951edba051fb9453bbf4e8961abbf559f6704

          SHA256

          1417b2131f5b7bb9d7acc1c2ffc1313ff3b47de1552f47f8fea8cae4087c2740

          SHA512

          85ca0c9507a37fb23c516f85ae0763d8a83f886763d922e502a8a2793a5b5484298663185f9b3ebf9525be75ddde104849ee4d3491f813bb6546301193651038

          Download Submit

        • C:\Program Files (x86)\StatMaker\StatMaker.dll
          Filesize

          1.9MB

          MD5

          78c8d1bc7fbb01b622ce76b7ae415f32

          SHA1

          487951edba051fb9453bbf4e8961abbf559f6704

          SHA256

          1417b2131f5b7bb9d7acc1c2ffc1313ff3b47de1552f47f8fea8cae4087c2740

          SHA512

          85ca0c9507a37fb23c516f85ae0763d8a83f886763d922e502a8a2793a5b5484298663185f9b3ebf9525be75ddde104849ee4d3491f813bb6546301193651038

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tf5d831960.dll
          Filesize

          1.9MB

          MD5

          78c8d1bc7fbb01b622ce76b7ae415f32

          SHA1

          487951edba051fb9453bbf4e8961abbf559f6704

          SHA256

          1417b2131f5b7bb9d7acc1c2ffc1313ff3b47de1552f47f8fea8cae4087c2740

          SHA512

          85ca0c9507a37fb23c516f85ae0763d8a83f886763d922e502a8a2793a5b5484298663185f9b3ebf9525be75ddde104849ee4d3491f813bb6546301193651038

          Download Submit

        • \??\c:\Program Files (x86)\StatMaker\StatMaker.dll
          Filesize

          1.9MB

          MD5

          78c8d1bc7fbb01b622ce76b7ae415f32

          SHA1

          487951edba051fb9453bbf4e8961abbf559f6704

          SHA256

          1417b2131f5b7bb9d7acc1c2ffc1313ff3b47de1552f47f8fea8cae4087c2740

          SHA512

          85ca0c9507a37fb23c516f85ae0763d8a83f886763d922e502a8a2793a5b5484298663185f9b3ebf9525be75ddde104849ee4d3491f813bb6546301193651038

          Download Submit

        • memory/384-153-0x000000007FA00000-0x000000007FD58000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/4944-146-0x000000007F3C0000-0x000000007F718000-memory.dmp

          Filesize

          3.3MB

          Download

        • memory/5116-132-0x000000007ED10000-0x000000007F009000-memory.dmp

          Filesize

          3.0MB

          Download

        • memory/5116-138-0x000000007E860000-0x000000007EBB8000-memory.dmp

          Filesize

          3.3MB

          Download