2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec

Analysis

max time kernel
98s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec.exe
Size

211KB
MD5

28e7bf52c035e1c6a7f7657f9c246d90
SHA1

e022dad67870e4afa88f6cb1c98e1d6b2ec5c178
SHA256

2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec
SHA512

1f24935f8a6700cad5d2c96551c3502a9f7ace2a05f4132270514cd62a3ef1a5d9beb98dbed2d15b11e45f15ce41677887d3ca0b50854b0e85470cce39061e59
SSDEEP

6144:Q21eiVrl1fo0As4KpxxbxDxxxx155nZxs1UoK4:z7Wts4KxxbxDxxxx15VZxa

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1632	jydekdj.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\jydekdj.exe	2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec.exe
File created	C:\PROGRA~3\Mozilla\xdldjol.dll	jydekdj.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1364	2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec.exe
1632	jydekdj.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1632	1420	taskeng.exe	29
PID 1420 wrote to memory of 1632	1420	taskeng.exe	29
PID 1420 wrote to memory of 1632	1420	taskeng.exe	29
PID 1420 wrote to memory of 1632	1420	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec.exe
"C:\Users\Admin\AppData\Local\Temp\2f4d59a9a979b2bcf9a8408d54af6f32d5d7c59a1e93b8fe2827f4afdf2593ec.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1364

C:\Windows\system32\taskeng.exe
taskeng.exe {2C433CDB-8788-42D0-9C5A-7B7232631F55} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\PROGRA~3\Mozilla\jydekdj.exe
  C:\PROGRA~3\Mozilla\jydekdj.exe -vamlaul
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\jydekdj.exe

Filesize
211KB

MD5
ef570edb93ee14d022b7a37d2b5a2d77

SHA1
8f5a16e8777b614f83317dcd575cd7285cbff757

SHA256
81533ecc6954ed464e380213adc49b2882647391c5f5d8f798bcf32c2bb17a31

SHA512
3bc3da99dbe4b75db7b3e8140fa8373a4a27499a96d2b0c8fcb71131542cc96a6c81f6d8d3c2c297b0ee9a85dcaf21a61e35bd18ccaa472cde66ff742eae042d

Download Submit
C:\PROGRA~3\Mozilla\jydekdj.exe

Filesize
211KB

MD5
ef570edb93ee14d022b7a37d2b5a2d77

SHA1
8f5a16e8777b614f83317dcd575cd7285cbff757

SHA256
81533ecc6954ed464e380213adc49b2882647391c5f5d8f798bcf32c2bb17a31

SHA512
3bc3da99dbe4b75db7b3e8140fa8373a4a27499a96d2b0c8fcb71131542cc96a6c81f6d8d3c2c297b0ee9a85dcaf21a61e35bd18ccaa472cde66ff742eae042d

Download Submit
memory/1364-55-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1364-56-0x0000000000310000-0x000000000036B000-memory.dmp

Filesize
364KB

Download
memory/1364-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1364-58-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1364-54-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1632-60-0x0000000000000000-mapping.dmp

Download
memory/1632-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1632-64-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/1632-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1632-66-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1632-67-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download