Analysis
-
max time kernel
103s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4.exe
Resource
win10v2004-20220812-en
General
-
Target
749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4.exe
-
Size
936KB
-
MD5
042d8ef1ade21c43d1006727dd404c50
-
SHA1
d6042778d75156db157f6ca9df82236c2ec5effe
-
SHA256
749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4
-
SHA512
9eb93194f123619749f5fa2643a54291b6f76d98f47037b643a45a5859aa886284cad87d898a1420487892ed0a1ed8dc6b6d86bc358f1fbb75db1f12e87c8633
-
SSDEEP
12288:CDJM/bXntAh+nhZoqQEHvVIzJPz//DdvdYkNQX1NYtFX0jPDl5pudl1lnNRybMYY:Cd6atqLHNk5TdvKX1NYtFXOMNwQ4/8X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1396 nkvxlye.exe -
Modifies AppInit DLL entries 2 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\mmpvyam.dll nkvxlye.exe File created C:\PROGRA~3\Mozilla\nkvxlye.exe 749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4.exe"C:\Users\Admin\AppData\Local\Temp\749fffb463a767075d81a8676c366a4297a1625c35e97f6aaf852d73fe1a44d4.exe"1⤵
- Drops file in Program Files directory
PID:2304
-
C:\PROGRA~3\Mozilla\nkvxlye.exeC:\PROGRA~3\Mozilla\nkvxlye.exe -xqialii1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1396
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
936KB
MD53468dfd48d15eabe39c1a7fff42c7d10
SHA176c5c5971e07461d33da3bccfdec8516993fadf3
SHA25607ed4284c19c217eeabf866d6f43bf31810f5425833b6f4c8f1799e2906716e4
SHA512dfb112d77fb22fb1bc3728b95bc26ad3af21b102185a8284e2d1394d76ff801e0aa1b0315133b3f979aea18a1cd34bf72522422dc84ab745a2f2fa92281c7601
-
Filesize
936KB
MD53468dfd48d15eabe39c1a7fff42c7d10
SHA176c5c5971e07461d33da3bccfdec8516993fadf3
SHA25607ed4284c19c217eeabf866d6f43bf31810f5425833b6f4c8f1799e2906716e4
SHA512dfb112d77fb22fb1bc3728b95bc26ad3af21b102185a8284e2d1394d76ff801e0aa1b0315133b3f979aea18a1cd34bf72522422dc84ab745a2f2fa92281c7601