Analysis
-
max time kernel
147s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 13:11
Behavioral task
behavioral1
Sample
88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe
Resource
win10v2004-20220812-en
General
-
Target
88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe
-
Size
135KB
-
MD5
49da45d1390201b6f770864402de125c
-
SHA1
c1e6dffbd1c843a5183bd65726a02525ffbd4603
-
SHA256
88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8
-
SHA512
f91f8beeaa261d794a6deace9ada9b7781aba1d1ada5398156d30800b46bd9cff7df6753ff57f714cd9da55fe22864cc2852821865b9b98b5461b19e51756977
-
SSDEEP
3072:vsi/0hhfx3jeNvkMO+niR2Sh1bsKo8h8Bma/Ytd2Fs8NRMp:vsi/o9tjeNsM5niMSh1QKo8h8dA/2i8Q
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4416-134-0x0000000000400000-0x0000000000454000-memory.dmp vmprotect C:\H30zjm\74ndONtv.dll vmprotect C:\H30zjm\74ndONtv.dll vmprotect behavioral2/memory/3988-145-0x0000000010000000-0x000000001004F000-memory.dmp vmprotect behavioral2/memory/3988-146-0x0000000010000000-0x000000001004F000-memory.dmp vmprotect -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3988 rundll32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\74ndONtv = "rundll32.exe C:\\H30zjm\\74ndONtv.dll,gouqi_Go" 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syotom = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
rundll32.exedescription pid process target process PID 3988 set thread context of 4368 3988 rundll32.exe svchost.exe -
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main svchost.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.naver.com" svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exerundll32.exedescription pid process target process PID 4416 wrote to memory of 3988 4416 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe rundll32.exe PID 4416 wrote to memory of 3988 4416 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe rundll32.exe PID 4416 wrote to memory of 3988 4416 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe rundll32.exe PID 4416 wrote to memory of 3896 4416 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe cmd.exe PID 4416 wrote to memory of 3896 4416 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe cmd.exe PID 4416 wrote to memory of 3896 4416 88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe cmd.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe PID 3988 wrote to memory of 4368 3988 rundll32.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe"C:\Users\Admin\AppData\Local\Temp\88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\H30zjm\74ndONtv.dll,gouqi_Go2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe3⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\88644b6c7f4f9f5b8dd0b8df891b1dda8abe5c0230d1a3ad23142722a015c7c8.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\H30zjm\74ndONtv.dllFilesize
100KB
MD5ac4dec0f5b9c4adb99758e5c04f0a458
SHA1b02e38da72496a51d0d466a6331fed35963f0f78
SHA2560525e7d373d87d2009272afbfef1e98d8ef9119790fed204db5da521564b10a3
SHA5123d0936c9cb5a8a514c009244a991c58a332f288364e11be10fd5bfabcc0d1efe68d99acde6bc3a9b8b205edbaaefbd5025d192105982bc0b85a9789ff5457fdd
-
C:\H30zjm\74ndONtv.dllFilesize
100KB
MD5ac4dec0f5b9c4adb99758e5c04f0a458
SHA1b02e38da72496a51d0d466a6331fed35963f0f78
SHA2560525e7d373d87d2009272afbfef1e98d8ef9119790fed204db5da521564b10a3
SHA5123d0936c9cb5a8a514c009244a991c58a332f288364e11be10fd5bfabcc0d1efe68d99acde6bc3a9b8b205edbaaefbd5025d192105982bc0b85a9789ff5457fdd
-
memory/3896-133-0x0000000000000000-mapping.dmp
-
memory/3988-132-0x0000000000000000-mapping.dmp
-
memory/3988-146-0x0000000010000000-0x000000001004F000-memory.dmpFilesize
316KB
-
memory/3988-145-0x0000000010000000-0x000000001004F000-memory.dmpFilesize
316KB
-
memory/4368-138-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4368-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4368-140-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4368-141-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4368-142-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4368-144-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4368-137-0x0000000000000000-mapping.dmp
-
memory/4416-134-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB