cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124

Analysis

max time kernel
184s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe
Size

192KB
MD5

be401dfec4ab64cb6e5450de30ba8d45
SHA1

fcd8c847898c3d766edeec4506baaab8203c2215
SHA256

cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124
SHA512

d64b4a319f88ea8cac7115f51bce660aa0bbaa3ab0274dc5351dbd41f6e729b3c0f26c1efa372f7863bb2eca4e4eb921007fa291d1d8b141abf8ad17fed35a4f
SSDEEP

3072:imR49FBIrTtcgcCeVrzTAx1H6OfUUpuXnJ5iLl7ZaxzP72m9pZneyTvKqBE:imR4LQcgcBr+rUznJ5iR0N72hyVBE

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff22854f.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ff22854f.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff22854f = "C:\\Users\\Admin\\AppData\\Roaming\\ff22854f.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*f22854f = "C:\\Users\\Admin\\AppData\\Roaming\\ff22854f.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff22854 = "C:\\ff22854f\\ff22854f.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*f22854 = "C:\\ff22854f\\ff22854f.exe"	explorer.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

66 myexternalip.com
56 ip-addr.es
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exeexplorer.exe

pid process

4676 cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe
116 explorer.exe

flow	ioc
66	myexternalip.com
56	ip-addr.es

pid	process
4676	cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe
116	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exeexplorer.exe

description	pid	process	target process
PID 4676 wrote to memory of 116	4676	cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe	explorer.exe
PID 4676 wrote to memory of 116	4676	cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe	explorer.exe
PID 4676 wrote to memory of 116	4676	cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe	explorer.exe
PID 116 wrote to memory of 4508	116	explorer.exe	svchost.exe
PID 116 wrote to memory of 4508	116	explorer.exe	svchost.exe
PID 116 wrote to memory of 4508	116	explorer.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe
"C:\Users\Admin\AppData\Local\Temp\cd7cdb0397d0ba51a12f6718a7d9d0f0f83c8f512916dd5977c6555ce17ac124.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\svchost.exe
-k netsvcs
3⤵
PID:4508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-134-0x0000000000000000-mapping.dmp

Download
memory/116-135-0x0000000000860000-0x0000000000885000-memory.dmp

Filesize
148KB

Download
memory/4508-136-0x0000000000000000-mapping.dmp

Download
memory/4508-137-0x00000000004A0000-0x00000000004C5000-memory.dmp

Filesize
148KB

Download
memory/4676-132-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download