Analysis

  • max time kernel
    156s
  • max time network
    167s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2022, 03:58

General

  • Target

    79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe

  • Size

    303KB

  • MD5

    0670f593b0bb7eede65397c7cf0562c6

  • SHA1

    ad6a176cc9d3b860f9784f627c0a96f856b9b394

  • SHA256

    79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b

  • SHA512

    d15c86c6968f7f6d4c18cd840729c3642edf56df846cfaf1b2334e515a9191d732cf1cd5a062314cc6a8f98c44ebed9e8747dc051ffc717236c78e65fa070573

  • SSDEEP

    6144:zxDPnPsHhCeTcT3qA3H1+L0UCxx5Mr38U6TgRoRw4MziGybX2czYcCW9U1:zJPnPiT83qeHsL+75Mb8UrdNzTylzYc2

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe
        "C:\Users\Admin\AppData\Local\Temp\79a9640a5963508a4ec0ee377e4279a9fefcb6ea9ffc32072944c8dee039d26b.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Users\Admin\AppData\Roaming\Zuet\emtu.exe
          "C:\Users\Admin\AppData\Roaming\Zuet\emtu.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1932
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\SLTDB93.bat"
          3⤵
          • Deletes itself
          PID:1924
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1360
      • C:\Windows\system32\taskhost.exe
        "taskhost.exe"
        1⤵
          PID:1248

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\SLTDB93.bat

          Filesize

          303B

          MD5

          7e2bd815362fc6e5620259d48ad2349c

          SHA1

          0720b54fbe9aaf94265dc4f5a8fe9845c9ab6ac8

          SHA256

          b10f7b741725cb63a3df22475b0fcb51c5fc120b01598682b10a809816f0d8ae

          SHA512

          734a9cdd0fbca0f26540120a3460ca41c78b9ea3e20954440b4341a0bf1732083d6ebd9e59e577dc2d1a0040fbb4b8a94a0563236f48c9fce4931accf9b1d89f

        • C:\Users\Admin\AppData\Roaming\Zuet\emtu.exe

          Filesize

          303KB

          MD5

          09d9a0e8d2cf838e7423d179b77e7714

          SHA1

          e3860cda84dd61b5d86a14c58a141fbceba3b78d

          SHA256

          0802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82

          SHA512

          02526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76

        • C:\Users\Admin\AppData\Roaming\Zuet\emtu.exe

          Filesize

          303KB

          MD5

          09d9a0e8d2cf838e7423d179b77e7714

          SHA1

          e3860cda84dd61b5d86a14c58a141fbceba3b78d

          SHA256

          0802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82

          SHA512

          02526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76

        • \Users\Admin\AppData\Roaming\Zuet\emtu.exe

          Filesize

          303KB

          MD5

          09d9a0e8d2cf838e7423d179b77e7714

          SHA1

          e3860cda84dd61b5d86a14c58a141fbceba3b78d

          SHA256

          0802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82

          SHA512

          02526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76

        • \Users\Admin\AppData\Roaming\Zuet\emtu.exe

          Filesize

          303KB

          MD5

          09d9a0e8d2cf838e7423d179b77e7714

          SHA1

          e3860cda84dd61b5d86a14c58a141fbceba3b78d

          SHA256

          0802e14bf8df12e89dc5b9a4a9a224fd162da5d44a7a896d98b28c28ee1e2c82

          SHA512

          02526d4d2e6bc26b4e948b56ef4f18a60eaad1ac9d3f9c8bfd88c3250fd937dbcb5687851c044821da1b174071e597cf2f384b8421f9cb074a217dc5745dee76

        • memory/1116-87-0x0000000001D60000-0x0000000001DA9000-memory.dmp

          Filesize

          292KB

        • memory/1116-94-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1116-56-0x0000000000401000-0x0000000000442000-memory.dmp

          Filesize

          260KB

        • memory/1116-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

          Filesize

          8KB

        • memory/1116-85-0x0000000001D60000-0x0000000001DA9000-memory.dmp

          Filesize

          292KB

        • memory/1116-103-0x0000000001D60000-0x0000000001DA9000-memory.dmp

          Filesize

          292KB

        • memory/1116-86-0x0000000001D60000-0x0000000001DA9000-memory.dmp

          Filesize

          292KB

        • memory/1116-88-0x0000000001D60000-0x0000000001DA9000-memory.dmp

          Filesize

          292KB

        • memory/1116-93-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1116-55-0x0000000000400000-0x0000000000450000-memory.dmp

          Filesize

          320KB

        • memory/1116-92-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1116-91-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1116-90-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1116-89-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1248-69-0x00000000002B0000-0x00000000002F9000-memory.dmp

          Filesize

          292KB

        • memory/1248-65-0x00000000002B0000-0x00000000002F9000-memory.dmp

          Filesize

          292KB

        • memory/1248-68-0x00000000002B0000-0x00000000002F9000-memory.dmp

          Filesize

          292KB

        • memory/1248-67-0x00000000002B0000-0x00000000002F9000-memory.dmp

          Filesize

          292KB

        • memory/1248-70-0x00000000002B0000-0x00000000002F9000-memory.dmp

          Filesize

          292KB

        • memory/1360-76-0x00000000002B0000-0x00000000002F9000-memory.dmp

          Filesize

          292KB

        • memory/1392-80-0x0000000002A40000-0x0000000002A89000-memory.dmp

          Filesize

          292KB

        • memory/1392-81-0x0000000002A40000-0x0000000002A89000-memory.dmp

          Filesize

          292KB

        • memory/1392-82-0x0000000002A40000-0x0000000002A89000-memory.dmp

          Filesize

          292KB

        • memory/1392-79-0x0000000002A40000-0x0000000002A89000-memory.dmp

          Filesize

          292KB

        • memory/1924-112-0x0000000000050000-0x0000000000099000-memory.dmp

          Filesize

          292KB

        • memory/1924-110-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-99-0x0000000000050000-0x0000000000099000-memory.dmp

          Filesize

          292KB

        • memory/1924-97-0x0000000000050000-0x0000000000099000-memory.dmp

          Filesize

          292KB

        • memory/1924-101-0x0000000000050000-0x0000000000099000-memory.dmp

          Filesize

          292KB

        • memory/1924-111-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-100-0x0000000000050000-0x0000000000099000-memory.dmp

          Filesize

          292KB

        • memory/1924-109-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-108-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-107-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-106-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-105-0x000000006FFF0000-0x0000000070000000-memory.dmp

          Filesize

          64KB

        • memory/1924-114-0x0000000000050000-0x0000000000099000-memory.dmp

          Filesize

          292KB