c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4

Analysis

max time kernel
147s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe
Size

108KB
MD5

cae5904d74215ed4e926fe5937f107c5
SHA1

3a660c16691e1bec3d368d9abddaf7dd41877eb8
SHA256

c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4
SHA512

37b3f8178626a3a38173a8db969703d9937a83c1bd010352d961116b485162ee11289941b83d51da497ad624d8d423d5b1e6903eb718e58317033c7a15a8c3fc
SSDEEP

3072:wp/CIHN+HR4SLPflnh3U0qkgszNFJl0nBSkrSZO6:E/xHN+x4SLPflhERkg4NOkYSA

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1428	rundll32.exe
5056	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cxubiki = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\cdmjprox.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe
1428	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2688	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe
1428	rundll32.exe
5056	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1428	2688	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	80
PID 2688 wrote to memory of 1428	2688	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	80
PID 2688 wrote to memory of 1428	2688	c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe	80
PID 1428 wrote to memory of 5056	1428	rundll32.exe	82
PID 1428 wrote to memory of 5056	1428	rundll32.exe	82
PID 1428 wrote to memory of 5056	1428	rundll32.exe	82

C:\Users\Admin\AppData\Local\Temp\c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe
"C:\Users\Admin\AppData\Local\Temp\c31b8a01a28f63cebdc73117294b0106c0c4ab8975002bd522c068d783f0efd4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\cdmjprox.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\cdmjprox.dll",iep
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cdmjprox.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
C:\Users\Admin\AppData\Local\cdmjprox.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
C:\Users\Admin\AppData\Local\cdmjprox.dll

Filesize
108KB

MD5
cbcf48ed079e019d1976f87b166d7b18

SHA1
05e703922956bc2a97eec9f40dc4ee9c93739bb3

SHA256
d7556b02987499a0b21a7ce382ce4b0b07894d6ab21902e075aece353d551804

SHA512
8f00f45dac46e35c8e5c8d1348dfc392cbc1d3cfb16e9128415d945b2284417116cfc39ea9c4c595b7863e64885274f7af71333119fc01a266ae831ebd4ceb5b

Download Submit
memory/1428-137-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/1428-138-0x0000000002331000-0x000000000233F000-memory.dmp

Filesize
56KB

Download
memory/2688-132-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2688-133-0x0000000000B11000-0x0000000000B1F000-memory.dmp

Filesize
56KB

Download
memory/5056-142-0x00000000028C1000-0x00000000028CF000-memory.dmp

Filesize
56KB

Download