a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3

Analysis

max time kernel
175s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe
Size 356KB
Sample221203-tmvxaseg54
SHA256 a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3
MD5 e2c55039932d6be54c069e0c1a449ff6
SHA1 f7b12e191b6a7cc08ed171953855ec18fbc201e3
SHA512 4f4c9e2045aca9742cc758775be30019718acdc53dfd7844f81cf4997b5732f5f6818aecbed998ca062f468058528700e93ebd7c766ef0f6801295cb41a9e529
SSDEEP 6144:7vbx8tjIFZxLalG6DpvkHdwrQTe9iqKA74YHdxuO7XV:7IuZtalLDpvkHdwrQTzI7TxuOh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3364	pBV6wmh5.exe
5096	pBV6wmh5.exe

Loads dropped DLL 4 IoCs

pid	Process
1836	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe
1836	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe
5096	pBV6wmh5.exe
5096	pBV6wmh5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oz0lGU6Eff99h3a = "C:\\ProgramData\\d18NBC7PIIKMPW6\\pBV6wmh5.exe"	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 956 set thread context of 1836	956	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	83
PID 3364 set thread context of 5096	3364	pBV6wmh5.exe	86
PID 5096 set thread context of 5016	5096	pBV6wmh5.exe	97

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1836	956	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	83
PID 956 wrote to memory of 1836	956	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	83
PID 956 wrote to memory of 1836	956	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	83
PID 956 wrote to memory of 1836	956	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	83
PID 956 wrote to memory of 1836	956	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	83
PID 1836 wrote to memory of 3364	1836	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	85
PID 1836 wrote to memory of 3364	1836	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	85
PID 1836 wrote to memory of 3364	1836	a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe	85
PID 3364 wrote to memory of 5096	3364	pBV6wmh5.exe	86
PID 3364 wrote to memory of 5096	3364	pBV6wmh5.exe	86
PID 3364 wrote to memory of 5096	3364	pBV6wmh5.exe	86
PID 3364 wrote to memory of 5096	3364	pBV6wmh5.exe	86
PID 3364 wrote to memory of 5096	3364	pBV6wmh5.exe	86
PID 5096 wrote to memory of 5016	5096	pBV6wmh5.exe	97
PID 5096 wrote to memory of 5016	5096	pBV6wmh5.exe	97
PID 5096 wrote to memory of 5016	5096	pBV6wmh5.exe	97
PID 5096 wrote to memory of 5016	5096	pBV6wmh5.exe	97
PID 5096 wrote to memory of 5016	5096	pBV6wmh5.exe	97

C:\Users\Admin\AppData\Local\Temp\a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe
"C:\Users\Admin\AppData\Local\Temp\a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe
  "C:\Users\Admin\AppData\Local\Temp\a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
    "C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
      "C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
        
        "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe" /i:5096
        5⤵
        
        PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pBV6wmh5.exe

Path C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
Size 356KB
SHA256 f97f0df18b2444fc4b614b5ffe03ab7041573717bd6f50072874b445c8e963e8
MD5 767e8530c187c2582c6ab2355172cea5
SHA1 c829d0071f4f01b10db44281464d264cdfbcc0b9
SHA512 30053e2aea6355bcd396a02d25a7c244ec1479a8954bd9106fa2d9d967412effc5fa7f52a61d3cbb3f7839512de48561a1d9b176149dd0b3da2063f1d63bc1ea
SSDEEP 6144:7vbx8f20vQjRss7YSvIgviU3+VRrNb2Jvo:7w20vQjRsstBopb21
MD5 SHA1 SHA512 SSDEEP

Submit Download

pBV6wmh5.exe

Path C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
Size 356KB
SHA256 f97f0df18b2444fc4b614b5ffe03ab7041573717bd6f50072874b445c8e963e8
MD5 767e8530c187c2582c6ab2355172cea5
SHA1 c829d0071f4f01b10db44281464d264cdfbcc0b9
SHA512 30053e2aea6355bcd396a02d25a7c244ec1479a8954bd9106fa2d9d967412effc5fa7f52a61d3cbb3f7839512de48561a1d9b176149dd0b3da2063f1d63bc1ea
SSDEEP 6144:7vbx8f20vQjRss7YSvIgviU3+VRrNb2Jvo:7w20vQjRsstBopb21
MD5 SHA1 SHA512 SSDEEP

Submit Download

pBV6wmh5.exe

Path C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
Size 356KB
SHA256 f97f0df18b2444fc4b614b5ffe03ab7041573717bd6f50072874b445c8e963e8
MD5 767e8530c187c2582c6ab2355172cea5
SHA1 c829d0071f4f01b10db44281464d264cdfbcc0b9
SHA512 30053e2aea6355bcd396a02d25a7c244ec1479a8954bd9106fa2d9d967412effc5fa7f52a61d3cbb3f7839512de48561a1d9b176149dd0b3da2063f1d63bc1ea
SSDEEP 6144:7vbx8f20vQjRss7YSvIgviU3+VRrNb2Jvo:7w20vQjRsstBopb21
MD5 SHA1 SHA512 SSDEEP

Submit Download

pBV6wmh5.exe

Path C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
Size 356KB
SHA256 a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3
MD5 e2c55039932d6be54c069e0c1a449ff6
SHA1 f7b12e191b6a7cc08ed171953855ec18fbc201e3
SHA512 4f4c9e2045aca9742cc758775be30019718acdc53dfd7844f81cf4997b5732f5f6818aecbed998ca062f468058528700e93ebd7c766ef0f6801295cb41a9e529
SSDEEP 6144:7vbx8tjIFZxLalG6DpvkHdwrQTe9iqKA74YHdxuO7XV:7IuZtalLDpvkHdwrQTzI7TxuOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

pBV6wmh5.exe

Path C:\ProgramData\d18NBC7PIIKMPW6\pBV6wmh5.exe
Size 356KB
SHA256 a45cf38817c9b649cbeae66339a36eb4438cea0aa282489c779ce23ce71182c3
MD5 e2c55039932d6be54c069e0c1a449ff6
SHA1 f7b12e191b6a7cc08ed171953855ec18fbc201e3
SHA512 4f4c9e2045aca9742cc758775be30019718acdc53dfd7844f81cf4997b5732f5f6818aecbed998ca062f468058528700e93ebd7c766ef0f6801295cb41a9e529
SSDEEP 6144:7vbx8tjIFZxLalG6DpvkHdwrQTe9iqKA74YHdxuO7XV:7IuZtalLDpvkHdwrQTzI7TxuOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

0O6cyK29pQ.exe

Path C:\Users\Admin\AppData\Local\Temp\0O6cyK29pQ.exe
Size 356KB
SHA256 f97f0df18b2444fc4b614b5ffe03ab7041573717bd6f50072874b445c8e963e8
MD5 767e8530c187c2582c6ab2355172cea5
SHA1 c829d0071f4f01b10db44281464d264cdfbcc0b9
SHA512 30053e2aea6355bcd396a02d25a7c244ec1479a8954bd9106fa2d9d967412effc5fa7f52a61d3cbb3f7839512de48561a1d9b176149dd0b3da2063f1d63bc1ea
SSDEEP 6144:7vbx8f20vQjRss7YSvIgviU3+VRrNb2Jvo:7w20vQjRsstBopb21
MD5 SHA1 SHA512 SSDEEP

Submit Download

0O6cyK29pQ.exe

Path C:\Users\Admin\AppData\Local\Temp\0O6cyK29pQ.exe
Size 356KB
SHA256 f97f0df18b2444fc4b614b5ffe03ab7041573717bd6f50072874b445c8e963e8
MD5 767e8530c187c2582c6ab2355172cea5
SHA1 c829d0071f4f01b10db44281464d264cdfbcc0b9
SHA512 30053e2aea6355bcd396a02d25a7c244ec1479a8954bd9106fa2d9d967412effc5fa7f52a61d3cbb3f7839512de48561a1d9b176149dd0b3da2063f1d63bc1ea
SSDEEP 6144:7vbx8f20vQjRss7YSvIgviU3+VRrNb2Jvo:7w20vQjRsstBopb21
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1836-136-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1836-142-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1836-135-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1836-134-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/1836-133-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5016-157-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5096-148-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5096-156-0x0000000000400000-0x000000000045E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads