a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443

Analysis

max time kernel
154s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe
Size 116KB
Sample221129-epc2yadc24
SHA256 a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443
MD5 9c98f8fd6f61c2d4852264b1369cd098
SHA1 11f78db1eb1b49ebef35e26f76fe8666be35b0ee
SHA512 23635e504dbb97ca898df206db1a00ee73abc14d0f05a8c8463c131377efecd163bad2dc2a4054406aed1cc8f98896060a60429b01af99911456c17c84fae120
SSDEEP 1536:Vs+jhi0Ckg2QtJoIvM4EXf5uEp54yhFeK0JJmlhU8KKbDHZyRFOJMeiO0mUQA+jG:eim2QtJoaUFP4Jj8DX0RFOXdTm+Ot
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3368	netprotocol.exe
3964	netprotocol.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 368	2884	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	81
PID 3368 set thread context of 3964	3368	netprotocol.exe	86

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2788	2884	WerFault.exe	80
4112	3368	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 368	2884	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	81
PID 2884 wrote to memory of 368	2884	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	81
PID 2884 wrote to memory of 368	2884	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	81
PID 2884 wrote to memory of 368	2884	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	81
PID 2884 wrote to memory of 368	2884	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	81
PID 368 wrote to memory of 3368	368	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	84
PID 368 wrote to memory of 3368	368	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	84
PID 368 wrote to memory of 3368	368	a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe	84
PID 3368 wrote to memory of 3964	3368	netprotocol.exe	86
PID 3368 wrote to memory of 3964	3368	netprotocol.exe	86
PID 3368 wrote to memory of 3964	3368	netprotocol.exe	86
PID 3368 wrote to memory of 3964	3368	netprotocol.exe	86
PID 3368 wrote to memory of 3964	3368	netprotocol.exe	86

C:\Users\Admin\AppData\Local\Temp\a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe
"C:\Users\Admin\AppData\Local\Temp\a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe
  C:\Users\Admin\AppData\Local\Temp\a40706a89ad24844ed6c4fa8bda86df956bc6be82161c44ea27862c95e736443.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      C:\Users\Admin\AppData\Roaming\netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:3964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 448
      4⤵
      Program crash
      PID:4112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 452
  2⤵
  - Program crash
  PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2884 -ip 2884
1⤵
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3368 -ip 3368
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netprotocol.exe

Path C:\Users\Admin\AppData\Roaming\netprotocol.exe
Size 116KB
SHA256 7ce0073ae925bc5da6675b2444ae8843bd153eb13990ca043a0ad5a8bc1cdafe
MD5 52d4b3f65955e63453695dd69d75f081
SHA1 901da487575c9ff9b4a1bf8adca9bfffa4349178
SHA512 bc2a04ce9a95333db8848f2a63df7d70c58fa15fc807c57d05bb3c812d29c7f624b4c02f0ee02a6c5a7233880f6a7cfa0fd2c7ffdc3d0ec8ef8678214921af80
SSDEEP 1536:5s+jhi0Ckg2QtJoIvM4EXf5uEp54yhFeK0JJmlhU8KKbDHZyRFOJMeiO0mUQA+jG:aim2QtJoaUFP4Jj8DX0RFOXdTm+Ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

netprotocol.exe

Path C:\Users\Admin\AppData\Roaming\netprotocol.exe
Size 116KB
SHA256 7ce0073ae925bc5da6675b2444ae8843bd153eb13990ca043a0ad5a8bc1cdafe
MD5 52d4b3f65955e63453695dd69d75f081
SHA1 901da487575c9ff9b4a1bf8adca9bfffa4349178
SHA512 bc2a04ce9a95333db8848f2a63df7d70c58fa15fc807c57d05bb3c812d29c7f624b4c02f0ee02a6c5a7233880f6a7cfa0fd2c7ffdc3d0ec8ef8678214921af80
SSDEEP 1536:5s+jhi0Ckg2QtJoIvM4EXf5uEp54yhFeK0JJmlhU8KKbDHZyRFOJMeiO0mUQA+jG:aim2QtJoaUFP4Jj8DX0RFOXdTm+Ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

netprotocol.exe

Path C:\Users\Admin\AppData\Roaming\netprotocol.exe
Size 116KB
SHA256 7ce0073ae925bc5da6675b2444ae8843bd153eb13990ca043a0ad5a8bc1cdafe
MD5 52d4b3f65955e63453695dd69d75f081
SHA1 901da487575c9ff9b4a1bf8adca9bfffa4349178
SHA512 bc2a04ce9a95333db8848f2a63df7d70c58fa15fc807c57d05bb3c812d29c7f624b4c02f0ee02a6c5a7233880f6a7cfa0fd2c7ffdc3d0ec8ef8678214921af80
SSDEEP 1536:5s+jhi0Ckg2QtJoIvM4EXf5uEp54yhFeK0JJmlhU8KKbDHZyRFOJMeiO0mUQA+jG:aim2QtJoaUFP4Jj8DX0RFOXdTm+Ot
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-135-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/368-134-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/368-133-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/368-139-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/368-146-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3964-143-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3964-144-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3964-145-0x0000000000400000-0x000000000042B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads