c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba

General

Target

c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
Size

294KB
MD5

2160ceb66c60ae733b763db9c91a3ee2
SHA1

4f9b9e35c0176a3a5de0885a0ddc22c70f86b0be
SHA256

c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba
SHA512

d6f77d48982b7efe8f2c98d668f39e6be2ae3408a0b4f0f85be81b27d48841a1e0d1211e511122e660b47ccd7fd32d5f0074043b3bd07bd1ed158b6058b93893
SSDEEP

3072:9ZKBKl0yDoZhlAqClYRJSIqyrcgJfIrg9SxXc7UTJNBgj7NwikzE6x:gKl0yDAluivSQrcgJ1SxMUT7uNRY

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\cyapsysfy = "{86818445-0e09-535e-1f1a-0e090ccd891f}"	rundll32.exe

Loads dropped DLL 3 IoCs

pid	Process
4776	rundll32.exe
4776	rundll32.exe
4776	rundll32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\plncflfsl.dll	rundll32.exe
File created	C:\Windows\SysWOW64\bxzorxrex.dll	rundll32.exe
File created	C:\Windows\SysWOW64\gdsbgjwa.dat	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
File created	C:\Windows\SysWOW64\plncflfsl.dll	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86818445-0e09-535e-1f1a-0e090ccd891f}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86818445-0e09-535e-1f1a-0e090ccd891f}\InprocServer32\ = "C:\\Windows\\SysWow64\\xtvkntnat.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86818445-0e09-535e-1f1a-0e090ccd891f}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86818445-0e09-535e-1f1a-0e090ccd891f}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86818445-0e09-535e-1f1a-0e090ccd891f}\	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
4776	rundll32.exe
4776	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
Token: SeDebugPrivilege	4776	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4776	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4776	3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe	81
PID 3988 wrote to memory of 4776	3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe	81
PID 3988 wrote to memory of 4776	3988	c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe	81

C:\Users\Admin\AppData\Local\Temp\c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe
"C:\Users\Admin\AppData\Local\Temp\c96a7f20951318b6ec88cfd38f3a64bcce6639f8cda31645b2eead74f4703bba.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\gdsbgjwa.dat ssygwre
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bxzorxrex.dll

Filesize
625KB

MD5
eccf28d7e5ccec24119b88edd160f8f4

SHA1
98509587a3d37a20b56b50fd57f823a1691a034c

SHA256
820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6

SHA512
c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670

Download Submit
C:\Windows\SysWOW64\gdsbgjwa.dat

Filesize
231KB

MD5
4faf917f0233708c4ebce2dcdc3dc2db

SHA1
cbe69b653059689c0ca110bdb78efc05864cc1d3

SHA256
49da0a11674df7cd3360d09c5a7562c75f77613724aa35c3ebdeb8e4bb5b3039

SHA512
f90dffcbc4a4266b6317ab16dae8c5bde3fe03ebe32b2958719507974257090f095b7300cde29d5b65bae7113bb22dfe6d3e6a9931b894fb22712e405a6db2f2

Download Submit
C:\Windows\SysWOW64\gdsbgjwa.dat

Filesize
231KB

MD5
4faf917f0233708c4ebce2dcdc3dc2db

SHA1
cbe69b653059689c0ca110bdb78efc05864cc1d3

SHA256
49da0a11674df7cd3360d09c5a7562c75f77613724aa35c3ebdeb8e4bb5b3039

SHA512
f90dffcbc4a4266b6317ab16dae8c5bde3fe03ebe32b2958719507974257090f095b7300cde29d5b65bae7113bb22dfe6d3e6a9931b894fb22712e405a6db2f2

Download Submit
C:\Windows\SysWOW64\plncflfsl.dll

Filesize
478KB

MD5
e99416267b61f52fa5ab994019efd359

SHA1
86d31eae707db7fe51d2556394fcf0e8e9f6b0fd

SHA256
768c286674371564b5e6095edb56e0a4231f341be895da69cfccca5160029774

SHA512
0a1c7579a9c787c2c1bef35f0660e72e74b42824e14ebea63b87ed25ddaf107e3746567bb431cab41a2f6719fad2c22d96e0715a1fe085d75805d7d66f7f05ae

Download Submit
memory/4776-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing