8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf

Analysis

max time kernel
151s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe
Size

124KB
MD5

81fecc4ece816dce0962e2d2f5f526dd
SHA1

4fa9ae96d9b5e3909797a630110f5b711543c6d8
SHA256

8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf
SHA512

af97c47bc50ef43da72dd00493552ad75de54ee835c249f81433b6b06ab3316361fd18350ec39019038df201ebadf30a42290cb8aee8f2ad3c5a050a829522ad
SSDEEP

1536:9ARFSkuwfTeuV7puOY2T9vo/ZDZC/1MZr7IJ0c6OB3QA/t2Og0Jtf1NX6ikl0csT:aHFrd7p58NYSZrcJ+O+VOg0JtTI7gv

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1452	rundll32.exe
4088	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cguya = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Profcr.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe
1452	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2876	8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe
1452	rundll32.exe
4088	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1452	2876	8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe	85
PID 2876 wrote to memory of 1452	2876	8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe	85
PID 2876 wrote to memory of 1452	2876	8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe	85
PID 1452 wrote to memory of 4088	1452	rundll32.exe	89
PID 1452 wrote to memory of 4088	1452	rundll32.exe	89
PID 1452 wrote to memory of 4088	1452	rundll32.exe	89

C:\Users\Admin\AppData\Local\Temp\8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe
"C:\Users\Admin\AppData\Local\Temp\8158bcc8ca0644ee3cafd79d27d7ba996f2a3ee6e47100437d0a983fb0bfa4cf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Profcr.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Profcr.dll",iep
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Profcr.dll

Filesize
124KB

MD5
f31dd96abe48108ccc3b0c6c092d2c4d

SHA1
730994b838ac040fc129b8ebc0c9a0febcb73cf4

SHA256
8d1798a78da4cc73a99e5a813aa5252d1b048fb79a60d093b5b3749ee3b5eea9

SHA512
2db14ef90ee5e04dac608e6d13478eabc5502f9884a2badd8ded32b570ee51d12487671d912eaa8b14df85280f1d3ab0d548346da3e3591dc04d0d367be5b130

Download Submit
C:\Users\Admin\AppData\Local\Profcr.dll

Filesize
124KB

MD5
f31dd96abe48108ccc3b0c6c092d2c4d

SHA1
730994b838ac040fc129b8ebc0c9a0febcb73cf4

SHA256
8d1798a78da4cc73a99e5a813aa5252d1b048fb79a60d093b5b3749ee3b5eea9

SHA512
2db14ef90ee5e04dac608e6d13478eabc5502f9884a2badd8ded32b570ee51d12487671d912eaa8b14df85280f1d3ab0d548346da3e3591dc04d0d367be5b130

Download Submit
C:\Users\Admin\AppData\Local\Profcr.dll

Filesize
124KB

MD5
f31dd96abe48108ccc3b0c6c092d2c4d

SHA1
730994b838ac040fc129b8ebc0c9a0febcb73cf4

SHA256
8d1798a78da4cc73a99e5a813aa5252d1b048fb79a60d093b5b3749ee3b5eea9

SHA512
2db14ef90ee5e04dac608e6d13478eabc5502f9884a2badd8ded32b570ee51d12487671d912eaa8b14df85280f1d3ab0d548346da3e3591dc04d0d367be5b130

Download Submit
memory/1452-138-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/1452-139-0x0000000002CE1000-0x0000000002CEF000-memory.dmp

Filesize
56KB

Download
memory/2876-132-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/2876-133-0x00000000008C0000-0x000000000093A000-memory.dmp

Filesize
488KB

Download
memory/2876-134-0x00000000008C0000-0x000000000093A000-memory.dmp

Filesize
488KB

Download
memory/4088-143-0x00000000025A1000-0x00000000025AF000-memory.dmp

Filesize
56KB

Download