Overview

overview

10

Static

static

3c749acb05...12.exe

windows7-x64

10

3c749acb05...12.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 14:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c749acb0552370a6d41e87c13fa66c3897cf923ba6eabd64d4ba5d9cf055912.exe

  • Size

    155KB

  • MD5

    05d894131da48f68009481f209933288

  • SHA1

    f6756060274cea91da4ec41d6b472842ef009a3b

  • SHA256

    3c749acb0552370a6d41e87c13fa66c3897cf923ba6eabd64d4ba5d9cf055912

  • SHA512

    69ae2d6247e9bc19f3baae5cba1695b5a2023a8fdb72eb6daa6db2d4e6b020100cbd00af20c5b83e8031deab644f703abc79086da3ae109bf931f3dda2e534ef

  • SSDEEP

    3072:2bm9g/M7Er4lQJWS9VM7dGm6ydOJoIArfYqbNjGXlk8BFLPHSeSI:Um9t7V2WSfMhGm6pJoIArf/5oa8BFO

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2180
    • C:\Users\Admin\AppData\Local\Temp\3c749acb0552370a6d41e87c13fa66c3897cf923ba6eabd64d4ba5d9cf055912.exe
      "C:\Users\Admin\AppData\Local\Temp\3c749acb0552370a6d41e87c13fa66c3897cf923ba6eabd64d4ba5d9cf055912.exe"
      2⤵
      • Registers COM server for autorun
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\{e0613d90-9b67-ae60-58f9-584af5f18b89}\n
    Filesize

    26KB

    MD5

    fab7de9eafea67f88e43003698024c86

    SHA1

    24a4ef27c29cdeabed5e0af867e3f568da40d0c9

    SHA256

    073b1f99871dc56a33dcd55af71d53482816bfc9b3ce5c78ee53bed31b428384

    SHA512

    b4a57a8cc564760526d4cce26ce24e80657c064df373c307bb90cf053d01d04bdfe1def41fedfeb7715e53d8481a98c94bc6f3bf33815b4571d898aa08553fcd

    Download Submit
  • C:\Users\Admin\AppData\Local\{e0613d90-9b67-ae60-58f9-584af5f18b89}\n
    Filesize

    26KB

    MD5

    fab7de9eafea67f88e43003698024c86

    SHA1

    24a4ef27c29cdeabed5e0af867e3f568da40d0c9

    SHA256

    073b1f99871dc56a33dcd55af71d53482816bfc9b3ce5c78ee53bed31b428384

    SHA512

    b4a57a8cc564760526d4cce26ce24e80657c064df373c307bb90cf053d01d04bdfe1def41fedfeb7715e53d8481a98c94bc6f3bf33815b4571d898aa08553fcd

    Download Submit
  • memory/5012-132-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download
  • memory/5012-133-0x0000000000670000-0x000000000068F000-memory.dmp
    Filesize

    124KB

    Download
  • memory/5012-136-0x0000000000400000-0x000000000042F000-memory.dmp
    Filesize

    188KB

    Download