ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262

Analysis

max time kernel
115s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2023, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db79ec986805ed620baaeed1e3329b65.exe
Size 4.7MB
Sample230127-vf9ybacb97
SHA256 ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
MD5 db79ec986805ed620baaeed1e3329b65
SHA1 0958615603ec5a321e203ce583a4f6449265d0fb
SHA512 e35c232d6cd6235fa5b77dcfcdef6efd3dc78bd64cf721582937c65eba7b390bffa3afc1c2f527c6b6ce7418e5efece812061b1062d9f2eb38451e98a594f244
SSDEEP 98304:Jax45ZA8pV1mHGY59/KhGNz+447RFbYg9RcYRUXlf4prfjJuGTyHKPdox:JK4E8pXSTz+4wFbYSuMUXlwprbJZGHrx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4132	ntlhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	db79ec986805ed620baaeed1e3329b65.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	34	Go-http-client/1.1

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 4132	2436	db79ec986805ed620baaeed1e3329b65.exe	88
PID 2436 wrote to memory of 4132	2436	db79ec986805ed620baaeed1e3329b65.exe	88
PID 2436 wrote to memory of 4132	2436	db79ec986805ed620baaeed1e3329b65.exe	88

C:\Users\Admin\AppData\Local\Temp\db79ec986805ed620baaeed1e3329b65.exe
"C:\Users\Admin\AppData\Local\Temp\db79ec986805ed620baaeed1e3329b65.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
  2⤵
  - Executes dropped EXE
  PID:4132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 728.7MB
SHA256 a98b2c7f8bd7867ffe8bb282f3546330e0afc7b86c69b5a73df5d0b81792a6ca
MD5 4c590e8b342e79fbae4d7221512e32c5
SHA1 7466ac34928449a42c18c8546206d3a3726dfa2c
SHA512 1779dcb3fe541bd593a4ac4181dee47072e58bb1a9932f92672b7dc84b862a7d0b3dbd5c801f4368fa342d4cd35ded9a0a2723dddbf9d844de16143da734b69f
SSDEEP 12582912:J7JUN2Mzpii4OXJa+BF9g0DqhGrERpNb/OhdSTOXWYcB9zM3RBmVJ8PdyYxhQiSq:1JKbiHOgmOsqUrEg4TO9cB9zMPuedyt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntlhost.exe

Path C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
Size 728.7MB
SHA256 a98b2c7f8bd7867ffe8bb282f3546330e0afc7b86c69b5a73df5d0b81792a6ca
MD5 4c590e8b342e79fbae4d7221512e32c5
SHA1 7466ac34928449a42c18c8546206d3a3726dfa2c
SHA512 1779dcb3fe541bd593a4ac4181dee47072e58bb1a9932f92672b7dc84b862a7d0b3dbd5c801f4368fa342d4cd35ded9a0a2723dddbf9d844de16143da734b69f
SSDEEP 12582912:J7JUN2Mzpii4OXJa+BF9g0DqhGrERpNb/OhdSTOXWYcB9zM3RBmVJ8PdyYxhQiSq:1JKbiHOgmOsqUrEg4TO9cB9zMPuedyt+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2436-132-0x0000000000400000-0x0000000000803000-memory.dmp

Download

memory/2436-138-0x0000000001A70000-0x0000000001A72000-memory.dmp

Download

memory/4132-142-0x0000000002B50000-0x0000000002F53000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads