b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab

Analysis

max time kernel
197s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
Size 429KB
Sample221206-1pz3csfh33
SHA256 b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab
MD5 e7e88c89b74034e8164640db5bd406c7
SHA1 b1464e8ffe65265f60bce1119c58834448bc91cd
SHA512 7157c65fee6867c57863e8f6447374d284d2d75d8211b29fe23282075f09dc6c59ce763d46b515fb43e08e845df36346799fae9dac4570f565bef92d6bb588aa
SSDEEP 1536:cHb2FTOaRIrHRgl7D7AFysbP0DOIqxLcakr/6W4j752aR1p/WVHJq:c72Bmxu/A4sD0DOb4aM4Bhh2HY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\herss.exe"	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	1376	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 2720	1376	b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2720
- C:\Users\Admin\AppData\Local\Temp\b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe
  "C:\Users\Admin\AppData\Local\Temp\b469bf6f3cffc6ebc1448744adf298c97b2d970b23c220943a3e9327202166ab.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 388
    3⤵
    - Program crash
    PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1376 -ip 1376
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvasds0.dll

Path C:\Users\Admin\AppData\Local\Temp\cvasds0.dll
Size 79KB
SHA256 d6bc2d7ba343bfe52415727fcb7aa568e184fa0fd0fd89a367e18ff218bb63e6
MD5 955250b10d8f30ba40abd128d9d7d9f7
SHA1 888c2944f81b7f1a6d764237b842fece9e41aa49
SHA512 dfcaa5a577de599e61c148b14705c18d60e820c717a716aafcc6c59d290946f170668c59ebd30dd90fdc774bbb3173ceb14b49eb26506919740d0069e95fdb42
SSDEEP 1536:Y2aL9jUUxs35DmYK0IMIyWxdE0/PZz6BTp8qAtGy1dyxOMjHqcQ02ah:3aRjPs3vIXFdp/RzOTxcIx/jVSah
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvasds0.dll

Path C:\Users\Admin\AppData\Local\Temp\cvasds0.dll
Size 79KB
SHA256 d6bc2d7ba343bfe52415727fcb7aa568e184fa0fd0fd89a367e18ff218bb63e6
MD5 955250b10d8f30ba40abd128d9d7d9f7
SHA1 888c2944f81b7f1a6d764237b842fece9e41aa49
SHA512 dfcaa5a577de599e61c148b14705c18d60e820c717a716aafcc6c59d290946f170668c59ebd30dd90fdc774bbb3173ceb14b49eb26506919740d0069e95fdb42
SSDEEP 1536:Y2aL9jUUxs35DmYK0IMIyWxdE0/PZz6BTp8qAtGy1dyxOMjHqcQ02ah:3aRjPs3vIXFdp/RzOTxcIx/jVSah
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-132-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1376-135-0x0000000010000000-0x0000000010068000-memory.dmp

Download

memory/1376-136-0x0000000010000000-0x0000000010068000-memory.dmp

Download