Overview

overview

8

Static

static

a495503939...0d.exe

windows7-x64

8

a495503939...0d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    190s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 15:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a495503939ddee1be57121606dd2962de73d7f8ef7fd762a647cd9a4a816e00d.exe

  • Size

    3.2MB

  • MD5

    7e1eb2270be513076fd2e331a5814de4

  • SHA1

    506f7292611f1fc0844a09e3d1f110601d03250c

  • SHA256

    a495503939ddee1be57121606dd2962de73d7f8ef7fd762a647cd9a4a816e00d

  • SHA512

    886ec398379ca245a657cb85b6787be7dd7633ddd42f3d1b1fdfad783ba9845db206b389389caa75bd7df39597c450224e71583a65dd816eb93f08c187d59a4c

  • SSDEEP

    98304:U6iau/uUQSG1RFOGyyfY6aT000psOU9P9XD:oau/uUQrHOGtYAsO

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 1 IoCs
  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a495503939ddee1be57121606dd2962de73d7f8ef7fd762a647cd9a4a816e00d.exe
    "C:\Users\Admin\AppData\Local\Temp\a495503939ddee1be57121606dd2962de73d7f8ef7fd762a647cd9a4a816e00d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 892
      2⤵
      • Program crash
      PID:3168
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\ProcessFoobar\ProcessFoobar.dll",serv -install
      2⤵
      • Loads dropped DLL
      PID:4344
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5028 -ip 5028
    1⤵
      PID:1292
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\ProcessFoobar\ProcessFoobar.dll",serv
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:484
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\ProcessFoobar\ProcessFoobar.dll",serv
        2⤵
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        PID:1528

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\ProcessFoobar\ProcessFoobar.dll
      Filesize

      2.2MB

      MD5

      e343a91c7b6661812afc62c2ea9c3b09

      SHA1

      fb87bd7e43838e44bd71d35c1a9204b8d12aef94

      SHA256

      029e3bcd4b5a1347e5688bae68dcc2f52168fd080259c365c6a99fe12c245609

      SHA512

      d5c819c9f9e359797c30acbd05a115f54f02fce7f696ae3ef8ff60a661511903681c4e08e4f118be9527692e870d5897ae8f626524fd044eb15ec1ea60449222

      Download Submit

    • C:\Program Files (x86)\ProcessFoobar\ProcessFoobar.dll
      Filesize

      2.2MB

      MD5

      e343a91c7b6661812afc62c2ea9c3b09

      SHA1

      fb87bd7e43838e44bd71d35c1a9204b8d12aef94

      SHA256

      029e3bcd4b5a1347e5688bae68dcc2f52168fd080259c365c6a99fe12c245609

      SHA512

      d5c819c9f9e359797c30acbd05a115f54f02fce7f696ae3ef8ff60a661511903681c4e08e4f118be9527692e870d5897ae8f626524fd044eb15ec1ea60449222

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tf52b8181b.dll
      Filesize

      2.2MB

      MD5

      e343a91c7b6661812afc62c2ea9c3b09

      SHA1

      fb87bd7e43838e44bd71d35c1a9204b8d12aef94

      SHA256

      029e3bcd4b5a1347e5688bae68dcc2f52168fd080259c365c6a99fe12c245609

      SHA512

      d5c819c9f9e359797c30acbd05a115f54f02fce7f696ae3ef8ff60a661511903681c4e08e4f118be9527692e870d5897ae8f626524fd044eb15ec1ea60449222

      Download Submit

    • \??\c:\Program Files (x86)\ProcessFoobar\ProcessFoobar.dll
      Filesize

      2.2MB

      MD5

      e343a91c7b6661812afc62c2ea9c3b09

      SHA1

      fb87bd7e43838e44bd71d35c1a9204b8d12aef94

      SHA256

      029e3bcd4b5a1347e5688bae68dcc2f52168fd080259c365c6a99fe12c245609

      SHA512

      d5c819c9f9e359797c30acbd05a115f54f02fce7f696ae3ef8ff60a661511903681c4e08e4f118be9527692e870d5897ae8f626524fd044eb15ec1ea60449222

      Download Submit

    • memory/1528-153-0x000000007EB50000-0x000000007EEA8000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4344-146-0x000000007EF50000-0x000000007F2A8000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/5028-132-0x000000007ECF0000-0x000000007F03A000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/5028-138-0x000000007E840000-0x000000007EB98000-memory.dmp

      Filesize

      3.3MB

      Download