beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa

Analysis

max time kernel
203s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe
Size

733KB
MD5

f39f3457f483da76676552f16c1407cc
SHA1

89cf2cca2b79b51af227161741e075ce368f2de0
SHA256

beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa
SHA512

08345b33cc4c073de14e09f2024f5386cec57dcb946c594567f28c691ec0972536386e2c351a9bdfaff74681814db20a945270744deef28cbf1d1a063e6c3726
SSDEEP

12288:yP9auzJPlyCV2B0DRLQSzNOCkQwUtAIuwz0jo/+l7C2VkyPOMPerYJQgLo4uT0cZ:49R18CcWtrhKIJzD07fV2uerfV4uRZ

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1820	server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 1820	812	beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe	82
PID 812 wrote to memory of 1820	812	beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe	82
PID 812 wrote to memory of 1820	812	beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe	82

C:\Users\Admin\AppData\Local\Temp\beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe
"C:\Users\Admin\AppData\Local\Temp\beb39958191c53701e157b85cb04d902b990d46aa5c511c302cbcd9f6b101afa.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
  2⤵
  - Executes dropped EXE
  PID:1820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
647KB

MD5
5ccb52a12bfd19e315fe44d7cadd9d46

SHA1
d3c2fa811bdd971420bcf731f99cd0fb3cbaba9f

SHA256
34726cd63559feddfe571989f68858d9d68caba1d06edfa67d8be01c9902b518

SHA512
16ffd98f6d944b6b2fe6d4e04048a4e37a43266911629d743cbbd650091e0abf9dc47d15b7ee0d92e2c1742d2132aa470b321d0b7adbe0ab275d8d73a1942612

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe

Filesize
647KB

MD5
5ccb52a12bfd19e315fe44d7cadd9d46

SHA1
d3c2fa811bdd971420bcf731f99cd0fb3cbaba9f

SHA256
34726cd63559feddfe571989f68858d9d68caba1d06edfa67d8be01c9902b518

SHA512
16ffd98f6d944b6b2fe6d4e04048a4e37a43266911629d743cbbd650091e0abf9dc47d15b7ee0d92e2c1742d2132aa470b321d0b7adbe0ab275d8d73a1942612

Download Submit
memory/812-132-0x0000000001000000-0x000000000117C5FA-memory.dmp

Filesize
1.5MB

Download
memory/812-133-0x0000000001000000-0x000000000117C5FA-memory.dmp

Filesize
1.5MB

Download
memory/812-134-0x0000000001000000-0x000000000117C5FA-memory.dmp

Filesize
1.5MB

Download
memory/812-136-0x0000000001000000-0x000000000117C5FA-memory.dmp

Filesize
1.5MB

Download
memory/812-140-0x0000000001000000-0x000000000117C5FA-memory.dmp

Filesize
1.5MB

Download