7360e5879b4c1b33a72e60288566c64e7d8b0caa1b37b7f35144a9cfaa17f202

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7360e5879b4c1b33a72e60288566c64e7d8b0caa1b37b7f35144a9cfaa17f202.exe
Size

202KB
MD5

8c983f75325d6e0813f614633e358fb0
SHA1

88415d18966529c49073022b75401613e99dd8bc
SHA256

7360e5879b4c1b33a72e60288566c64e7d8b0caa1b37b7f35144a9cfaa17f202
SHA512

a3cfa6a45f5b3bfff41c819d2c6e851d15ddce96ada5a2ce3db88d7897e068e748340f0f9db0cb0ee879d423f785d612879602dfeb1382f493a39002478b8cc0
SSDEEP

6144:CDJVazMKV31FdaQvXluxqU+A/0y+nt75voqQEu:CDJM/bXntAh+nhZoqQEu

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
832	wlgmldg.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fkvcmeb.dll	wlgmldg.exe
File created	C:\PROGRA~3\Mozilla\wlgmldg.exe	7360e5879b4c1b33a72e60288566c64e7d8b0caa1b37b7f35144a9cfaa17f202.exe

C:\Users\Admin\AppData\Local\Temp\7360e5879b4c1b33a72e60288566c64e7d8b0caa1b37b7f35144a9cfaa17f202.exe
"C:\Users\Admin\AppData\Local\Temp\7360e5879b4c1b33a72e60288566c64e7d8b0caa1b37b7f35144a9cfaa17f202.exe"
1⤵
- Drops file in Program Files directory
PID:4996

C:\PROGRA~3\Mozilla\wlgmldg.exe
C:\PROGRA~3\Mozilla\wlgmldg.exe -tefqmxb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\wlgmldg.exe

Filesize
202KB

MD5
1301613c90fa47db501197decf281b51

SHA1
8579a42df50ea8dfb5a3a07ae5fa1338df525247

SHA256
c9329dc985d6cdbb1e59070f1fa786a8b05a203accc0390ebf0143afa9ca9aea

SHA512
f2204beac0de3abc40b7d2d2d3659bb2d17af9a2d839b59038288fd56d0ffe02c8269e4ce74002c233a8fd4b213a4228740b91339e2bc3a662781cfd4aab1af5

Download Submit
C:\ProgramData\Mozilla\wlgmldg.exe

Filesize
202KB

MD5
1301613c90fa47db501197decf281b51

SHA1
8579a42df50ea8dfb5a3a07ae5fa1338df525247

SHA256
c9329dc985d6cdbb1e59070f1fa786a8b05a203accc0390ebf0143afa9ca9aea

SHA512
f2204beac0de3abc40b7d2d2d3659bb2d17af9a2d839b59038288fd56d0ffe02c8269e4ce74002c233a8fd4b213a4228740b91339e2bc3a662781cfd4aab1af5

Download Submit
memory/832-140-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/832-141-0x0000000000590000-0x00000000005EB000-memory.dmp

Filesize
364KB

Download
memory/832-146-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4996-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4996-133-0x0000000000890000-0x00000000008EB000-memory.dmp

Filesize
364KB

Download