c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef

Analysis

max time kernel
9s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
Size

150KB
MD5

fa5b31f9a4b6ed0f5d287e54f8da7f9e
SHA1

f8a7c3f162ec3a709e6ff48dd2200822d72757f6
SHA256

c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef
SHA512

638f79a67a116f4d5c19bd578e801bf27df3169244db9d69c3fe91f3299c880c5792385e6f3c3a9dadfd712c4f2fc088fd0d1246489fb5898ada7c6c3aacfb96
SSDEEP

3072:9qGLpya/2Yp9yhhJnrVbI/SDRXs+Ak1bjzzkdzZJeG6CugxTZ:U2tuJxa/SFnBvIZJePCuU

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a0000000122cd-55.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoosoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\herss.exe"	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe

Suspicious behavior: MapViewOfSection 22 IoCs

pid	Process
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 368	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	5
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 384	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	4
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 420	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	3
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 464	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	2
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 480	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	1
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 488	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	8
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 596	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	27
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 672	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	26
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 756	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	25
PID 2028 wrote to memory of 820	2028	c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe	9

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1316
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:336
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1248
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1172
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1112
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1036
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:328
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:892
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:856
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2036

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1972

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe
  "C:\Users\Admin\AppData\Local\Temp\c3be0654a5b65e30a8a5ab8c7a8727a6226e87486904f83ededc28e685cb62ef.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\cvasds0.dll

Filesize
88KB

MD5
035b88fc7e16aac5dbacc057a0b5c7fc

SHA1
e4e509cf7afb2ba31b15b15e5e1a45bf139323cc

SHA256
14888606d6dfb4836c4f752c55dfb8ae7dee47ae586c8d7d04f67f9d5d523144

SHA512
d432a9fada8585603b7546c87259fcbab193e00383012e6c3dfd75276588facd02fbc61645aac95ae2b5ce06f50b9c1b8d9608f64f6b65a8aef717e67d34c92c

Download Submit
memory/2028-54-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2028-56-0x0000000010000000-0x000000001006D000-memory.dmp

Filesize
436KB

Download