Analysis
-
max time kernel
176s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe
-
Size
32KB
-
MD5
03ead015111f74c879f36774077ef010
-
SHA1
8f874311e3315d7a8083ed7583b10aae3df1f369
-
SHA256
53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd
-
SHA512
bcba2db4a547df90bfb3339223d4a8750dd9d3be57a370f5c8dda1ae5f7dd6f7d8d7d05f45f5a4f206d2d3e2f16685dacf7c1c0c9ce784836606ef91da4283e3
-
SSDEEP
768:kLeBPGvLAkgaY9yrpZN0+ZxLzHC1DBmh26L1b9DqVnnbcuyD7UBW:kSPGzAQCsDa01i1GDqJnouy8U
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\r: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\v: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\x: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\z: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\e: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\i: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\j: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\k: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\m: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\u: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\w: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\f: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\h: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\t: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\g: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\l: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\n: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\p: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\q: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\s: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File opened (read-only) \??\y: 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\240604859.BJT 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\redlteck\heoifz.pif 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe File created C:\Program Files (x86)\Common Files\redlteck\heoifz.pif 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32\ = "C:\\Windows\\SysWow64\\240604859.BJT" 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe Token: SeDebugPrivilege 1448 53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe"C:\Users\Admin\AppData\Local\Temp\53202d28686afcbc18cda3f9f220122ed1ae456fc73f83c5ace7a902e36a8fcd.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD591dd6fe042732aabd2c14e0517cef3f6
SHA178f2bc3f30323ac5e11c88eaa0064469f12a370d
SHA25658a58e09c0e3c4a0cdaa0466ab09193a3530e6b4fa86053b4098f7eee95210ab
SHA512d8c0bab39e09333575d657e16bd349789c5bec0fcad950eed1aa54a6c61ae35e23bdebe244e1a290347c3648cf5a43e9be773c76a1d141ce8117592337022f11