44351af79b24e580f9b8275ea7480fcbda0e0d0b8f0843334ed9f6c9dce9cf15

Analysis

max time kernel
171s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44351af79b24e580f9b8275ea7480fcbda0e0d0b8f0843334ed9f6c9dce9cf15.exe
Size

247KB
MD5

1d4af3bc614b03df60e0ca358c82b570
SHA1

13d25fd39db9aa0dbf3b3fbc1af438bbc46ea727
SHA256

44351af79b24e580f9b8275ea7480fcbda0e0d0b8f0843334ed9f6c9dce9cf15
SHA512

757903ed5ed679503b81789f537e6fb8124c171e96f6ab14cb1ec15e4c7f7f9468c68019780155631aa75e16244ac8b79cb59f0bcb0d824a4c597f9d5c095f7f
SSDEEP

6144:fRh8kXpF13fIRj2N0cp7Yfh2xrtAbUR6A8U5Ccyz/dhZ:L/D6d+j9YmAbURT8U5RyhhZ

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1036	znblaln.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\znblaln.exe	44351af79b24e580f9b8275ea7480fcbda0e0d0b8f0843334ed9f6c9dce9cf15.exe
File created	C:\PROGRA~3\Mozilla\czmmuxc.dll	znblaln.exe

C:\Users\Admin\AppData\Local\Temp\44351af79b24e580f9b8275ea7480fcbda0e0d0b8f0843334ed9f6c9dce9cf15.exe
"C:\Users\Admin\AppData\Local\Temp\44351af79b24e580f9b8275ea7480fcbda0e0d0b8f0843334ed9f6c9dce9cf15.exe"
1⤵
- Drops file in Program Files directory
PID:1684

C:\PROGRA~3\Mozilla\znblaln.exe
C:\PROGRA~3\Mozilla\znblaln.exe -irlyaih
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\znblaln.exe

Filesize
247KB

MD5
a796322839fdac99c003bdac2c2e91bc

SHA1
60e0dd7dff41780571f1d3851e9e5d5cfd772128

SHA256
e93282d8bffebb78f563381d784d1ff97a75acf86f315317f34df6faa341045a

SHA512
89cb29aa2f455a92ae2d3744bf10581d95c627d743b9b573671a9035580b8f8d47ebf16251d4b7e6dd4c4eae9864fdeec89064be90ca780ee5c3fbd525f4c91a

Download Submit
C:\ProgramData\Mozilla\znblaln.exe

Filesize
247KB

MD5
a796322839fdac99c003bdac2c2e91bc

SHA1
60e0dd7dff41780571f1d3851e9e5d5cfd772128

SHA256
e93282d8bffebb78f563381d784d1ff97a75acf86f315317f34df6faa341045a

SHA512
89cb29aa2f455a92ae2d3744bf10581d95c627d743b9b573671a9035580b8f8d47ebf16251d4b7e6dd4c4eae9864fdeec89064be90ca780ee5c3fbd525f4c91a

Download Submit
memory/1036-141-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1036-142-0x0000000000580000-0x00000000005DB000-memory.dmp

Filesize
364KB

Download
memory/1684-132-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1684-133-0x0000000000910000-0x000000000096B000-memory.dmp

Filesize
364KB

Download
memory/1684-140-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download