b72f222928dada0a651782c863ea29cd26241aa31ceda87bdad68ea7c57d04c5

General

Target
f4f8d570644df1967ca104159efec28a.exe
Size 2.1MB
Sample230128-vx5d6afd69
SHA256 b72f222928dada0a651782c863ea29cd26241aa31ceda87bdad68ea7c57d04c5
MD5 f4f8d570644df1967ca104159efec28a
SHA1 053de3dc892d765c631ef8639ac2f8a126e3bdcf
SHA512 d3d2a139291c3422cf00ecf31d8b3bd11471aaf0fcde2a83baddc91c46a6453e3814d07b3808223ce89dbe8f424d39a17d4a21c6ebb88085e3dc4eb9b9b56862
SSDEEP 49152:ZU+UpzEOI24PFlUE/17GYwM7Op9SNeql3WegBSSXOI6m1zpoRuc4:PyEOIlFeE/1XDlGegM3ooRu
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3724	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f4f8d570644df1967ca104159efec28a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f4f8d570644df1967ca104159efec28a.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	conhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	conhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	conhost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe
3724	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2556	4544	f4f8d570644df1967ca104159efec28a.exe	81
PID 4544 wrote to memory of 2556	4544	f4f8d570644df1967ca104159efec28a.exe	81
PID 4544 wrote to memory of 2556	4544	f4f8d570644df1967ca104159efec28a.exe	81
PID 2556 wrote to memory of 3724	2556	cmd.exe	83
PID 2556 wrote to memory of 3724	2556	cmd.exe	83
PID 2556 wrote to memory of 3724	2556	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\f4f8d570644df1967ca104159efec28a.exe
"C:\Users\Admin\AppData\Local\Temp\f4f8d570644df1967ca104159efec28a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bswszkywvog.bat 30611318
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lhxawiewu.dat 30611318
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bswszkywvog.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bswszkywvog.bat
Size 118B
SHA256 aaaab10442e7dfa56631f527e0b3fca1d53fa42b9745b3cd86b65de11447429e
MD5 31e567842e55692a27f2d6d218da1ce2
SHA1 7f5fe240162e32f5d78cda0bd13df6eefd2ecaa1
SHA512 1b6d7137c99d37fd496c3663b59eeb87716c73d6f7402ee7a0b543d80f389eed9a0ef34489757f9b77ae0b96bddd06fc9c49a4dca7ed7cb22960e5d0508015f5
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

evynifmqfmo.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\evynifmqfmo.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

evynifmqfmo.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\evynifmqfmo.dat.1
Size 2B
SHA256 ccc8d02c8169fdaeaaa52f9c74dfa3e1238ac5d0e89bc35223d423517f8e2b2d
MD5 873e009ecf0ccec19b3570baf5e70305
SHA1 d68e129e2ac27d06de80d1b16c1c4c4f589523f1
SHA512 4e483d49046751b02d209650cd1d82df15a3a99a41036c60fb4a1318df61fb7b51236442e5ad1e3116249737721e9aa6717becba1b2ef1ddc4fece5fca756f7e
MD5 SHA1 SHA512

Submit Download

evynifmqfmo.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\evynifmqfmo.dat.2
Size 5.2MB
SHA256 476208c256cd4a02d786e1921955c3403f5daa393f8823eb54207211158d8634
MD5 81128d3275a25973f6d3890a7170916c
SHA1 cd843ece3d182a8c9c98f568745715dd5026e896
SHA512 59ac0665a85d0b11e2f45412477627c0b2aa53f2ebf550281c73f5735a2a50073f6e60cedc9e2092be075fb92426b37dbc6ca310b7a6844f9aeb6f750dc7193a
SSDEEP 49152:Y6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:YbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lhxawiewu.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lhxawiewu.dat
Size 377KB
SHA256 0e22182a7f473b26e516c729ede7f17a1a380922cf1ad530e4034a20fca50348
MD5 5816c4434f64bc3512e18ab2f7b21de3
SHA1 38b5c54dd9ad07508907ab63e05ef6467a996785
SHA512 cee4682bea3f74998afe3d9bea161496d0182d90f729057af20bae414d02c8c1be8297325358514ec0191a829d2ef80f4bfdd2f7ec3ddd51355530e9f54ddc7f
SSDEEP 6144:Hl3V230cOe/C4AjHkuHICxzlCTDLMDyfHUB+QAaOkztlDWIx8j7F+Rvu9AWjCXim:Y0bemLpfhlKl0g63DW0xRG9AyB+qwEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads