eed98c3dd55f27a2be5b8541b4855244fb065ade41ded068ab1317c776a09688

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3F5D43765B9861EF7FB6934E4F3BC696.exe
Size

343KB
MD5

3f5d43765b9861ef7fb6934e4f3bc696
SHA1

06fcd3e560876ad05f2f582f91547a04bff829f1
SHA256

eed98c3dd55f27a2be5b8541b4855244fb065ade41ded068ab1317c776a09688
SHA512

f9125a3a044f57bf4f3d169afcec97df7290fc2898aa2732c0e8b5afb2a5aa7099067f9e96e4644b6e0ffc5206c100654406baa7005b7071aaf9975d37c519aa
SSDEEP

3072:DQ8Jstxp5/YDHh8fzYQYwRVyv6MIWoy+hdEdZTpDbexB7sg+Rhtk7v:UBxpkhFQt4v67oA6rgsrIL

Score

10^/10

persistence phishing

Malware Config

Signatures

Detected phishing page
phishing
Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c040e174.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c040e174.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c040e17 = "C:\\c040e174\\c040e174.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*040e17 = "C:\\c040e174\\c040e174.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c040e174 = "C:\\Users\\Admin\\AppData\\Roaming\\c040e174.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*040e174 = "C:\\Users\\Admin\\AppData\\Roaming\\c040e174.exe"	explorer.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ip-addr.es
5 ip-addr.es
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3F5D43765B9861EF7FB6934E4F3BC696.exeexplorer.exe

pid process

5040 3F5D43765B9861EF7FB6934E4F3BC696.exe
1884 explorer.exe

flow	ioc
7	ip-addr.es
5	ip-addr.es

pid	process
5040	3F5D43765B9861EF7FB6934E4F3BC696.exe
1884	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3F5D43765B9861EF7FB6934E4F3BC696.exeexplorer.exe

description	pid	process	target process
PID 5040 wrote to memory of 1884	5040	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 5040 wrote to memory of 1884	5040	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 5040 wrote to memory of 1884	5040	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 1884 wrote to memory of 3756	1884	explorer.exe	svchost.exe
PID 1884 wrote to memory of 3756	1884	explorer.exe	svchost.exe
PID 1884 wrote to memory of 3756	1884	explorer.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\3F5D43765B9861EF7FB6934E4F3BC696.exe
"C:\Users\Admin\AppData\Local\Temp\3F5D43765B9861EF7FB6934E4F3BC696.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\svchost.exe
-k netsvcs
3⤵
PID:3756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-134-0x0000000000000000-mapping.dmp

Download
memory/1884-136-0x0000000000FA0000-0x0000000000FC5000-memory.dmp

Filesize
148KB

Download
memory/3756-137-0x0000000000000000-mapping.dmp

Download
memory/3756-138-0x0000000000B40000-0x0000000000B65000-memory.dmp

Filesize
148KB

Download
memory/3756-139-0x0000000000B40000-0x0000000000B65000-memory.dmp

Filesize
148KB

Download
memory/5040-132-0x00000000005A0000-0x00000000005C2000-memory.dmp

Filesize
136KB

Download
memory/5040-133-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5040-135-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download