c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8

Analysis

max time kernel
33s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe
Size

800KB
MD5

88d4421ecc1a1916d2df45b650e36720
SHA1

d54e5718d682da019edb1ab20eee7a9fbf3df75e
SHA256

c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8
SHA512

61d57ae0bd71f3a94c2ce77f5cda40bb641ddc609cce5b8ffa742e306d1130ed6676e2169b72b7507d5cf5ad43207f8f7790610732cd117a84631292f7dc38aa
SSDEEP

12288:RLocw+bbjB1D6U+s802ziOQ6/d+QXkkza6GOL9BkxcQiOOQu7aEcC:/vD5+GE/kscc3ku1hQuEC

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1696	Stub.exe

Loads dropped DLL 2 IoCs

pid	Process
1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe
1696	Stub.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27
PID 1880 wrote to memory of 1696	1880	c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe	27

C:\Users\Admin\AppData\Local\Temp\c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe
"C:\Users\Admin\AppData\Local\Temp\c0928c2fc80b495d8e2c5ac3118a0142805c3feb276875e78d8a6d66d830d1f8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stub.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stub.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stub.exe

Filesize
369KB

MD5
d573b4707e9a3fe2ed2cf94868384ca1

SHA1
3ad3b2c4a4e383cf7901d4c6c8c70ce80607be3f

SHA256
65f3a272e92fd95d1ec7d857e1a8d7d79788bbf62940137e61482b04509613ec

SHA512
92ddf044b2822007dcf470b7877a64b60a0c0ce7639eb3952410a84c35f25f50224416469667a487040d98dba280ecb0e378134084e6409483383e7ba537cfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stub.exe

Filesize
369KB

MD5
d573b4707e9a3fe2ed2cf94868384ca1

SHA1
3ad3b2c4a4e383cf7901d4c6c8c70ce80607be3f

SHA256
65f3a272e92fd95d1ec7d857e1a8d7d79788bbf62940137e61482b04509613ec

SHA512
92ddf044b2822007dcf470b7877a64b60a0c0ce7639eb3952410a84c35f25f50224416469667a487040d98dba280ecb0e378134084e6409483383e7ba537cfcc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stub.exe

Filesize
369KB

MD5
d573b4707e9a3fe2ed2cf94868384ca1

SHA1
3ad3b2c4a4e383cf7901d4c6c8c70ce80607be3f

SHA256
65f3a272e92fd95d1ec7d857e1a8d7d79788bbf62940137e61482b04509613ec

SHA512
92ddf044b2822007dcf470b7877a64b60a0c0ce7639eb3952410a84c35f25f50224416469667a487040d98dba280ecb0e378134084e6409483383e7ba537cfcc

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\Stub.exe

Filesize
369KB

MD5
d573b4707e9a3fe2ed2cf94868384ca1

SHA1
3ad3b2c4a4e383cf7901d4c6c8c70ce80607be3f

SHA256
65f3a272e92fd95d1ec7d857e1a8d7d79788bbf62940137e61482b04509613ec

SHA512
92ddf044b2822007dcf470b7877a64b60a0c0ce7639eb3952410a84c35f25f50224416469667a487040d98dba280ecb0e378134084e6409483383e7ba537cfcc

Download Submit
memory/1696-61-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1696-62-0x0000000000276000-0x0000000000287000-memory.dmp

Filesize
68KB

Download
memory/1696-63-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1880-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download