Analysis
-
max time kernel
172s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 15:01
Static task
static1
Behavioral task
behavioral1
Sample
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe
Resource
win10v2004-20221111-en
General
-
Target
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe
-
Size
408KB
-
MD5
65dad6ae8ab212a8a338d119de58fcc6
-
SHA1
b2bd04fccd5d027d61b5e0d9007b6b4a5194a36f
-
SHA256
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c
-
SHA512
22edd1867a9c85744d2686e84af0b3b87f400dcc0c4edb7a377ee503ce7a68556f7cc642b42d9b692bd06b4f4a4ebaae537660ac0f22b5b7e9b24e5fc5e05dbc
-
SSDEEP
6144:JUqKaDGsDT5/T4zxkiuZibyzcZQVfHbcw+yxoFdgoerBgM:JU5Hc/T4mrZKyQqvwb2o7fe1
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exepid process 308 svchost.exe 2512 svchost.exe 3664 svchost.exe 4576 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "\\Default Folder\\Default File.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Default Key = "C:\\Users\\Admin\\AppData\\Roaming\\Default Folder\\Default File.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exedescription pid process target process PID 4700 set thread context of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 4576 svchost.exe Token: SeDebugPrivilege 4576 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exepid process 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exedescription pid process target process PID 4700 wrote to memory of 308 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 308 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 308 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 2512 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 2512 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 2512 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 3664 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 3664 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 3664 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe PID 4700 wrote to memory of 4576 4700 a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe"C:\Users\Admin\AppData\Local\Temp\a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a526c3cf34f989c6951ad91b63773bdccf5abcbd504c3639873789d49024fb0c.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
32KB
MD53a77a4f220612fa55118fb8d7ddae83c
SHA1b96fa726fc84fd46d03dd3c32689f645e0422278
SHA2562cd6aacd0ed0f477f62833b13b97c26135f436dc59b0b09d4515a6c13cfe6e1f
SHA51233a9cfc23d49505d7f2e1af4299ea2e6ccbe36daccc81c3dafc9652b8259083da88ee67312035e88dcbc1a6d76ce2c13b6067b6dbcc2afd310b91d4ee737c94d
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
32KB
MD53a77a4f220612fa55118fb8d7ddae83c
SHA1b96fa726fc84fd46d03dd3c32689f645e0422278
SHA2562cd6aacd0ed0f477f62833b13b97c26135f436dc59b0b09d4515a6c13cfe6e1f
SHA51233a9cfc23d49505d7f2e1af4299ea2e6ccbe36daccc81c3dafc9652b8259083da88ee67312035e88dcbc1a6d76ce2c13b6067b6dbcc2afd310b91d4ee737c94d
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
32KB
MD53a77a4f220612fa55118fb8d7ddae83c
SHA1b96fa726fc84fd46d03dd3c32689f645e0422278
SHA2562cd6aacd0ed0f477f62833b13b97c26135f436dc59b0b09d4515a6c13cfe6e1f
SHA51233a9cfc23d49505d7f2e1af4299ea2e6ccbe36daccc81c3dafc9652b8259083da88ee67312035e88dcbc1a6d76ce2c13b6067b6dbcc2afd310b91d4ee737c94d
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
32KB
MD53a77a4f220612fa55118fb8d7ddae83c
SHA1b96fa726fc84fd46d03dd3c32689f645e0422278
SHA2562cd6aacd0ed0f477f62833b13b97c26135f436dc59b0b09d4515a6c13cfe6e1f
SHA51233a9cfc23d49505d7f2e1af4299ea2e6ccbe36daccc81c3dafc9652b8259083da88ee67312035e88dcbc1a6d76ce2c13b6067b6dbcc2afd310b91d4ee737c94d
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
32KB
MD53a77a4f220612fa55118fb8d7ddae83c
SHA1b96fa726fc84fd46d03dd3c32689f645e0422278
SHA2562cd6aacd0ed0f477f62833b13b97c26135f436dc59b0b09d4515a6c13cfe6e1f
SHA51233a9cfc23d49505d7f2e1af4299ea2e6ccbe36daccc81c3dafc9652b8259083da88ee67312035e88dcbc1a6d76ce2c13b6067b6dbcc2afd310b91d4ee737c94d
-
memory/4576-138-0x0000000000000000-mapping.dmp
-
memory/4576-139-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/4576-144-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4576-145-0x0000000074B30000-0x00000000750E1000-memory.dmpFilesize
5.7MB
-
memory/4700-134-0x0000000002230000-0x0000000002236000-memory.dmpFilesize
24KB