3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Slither x32y 64/dxwebsetup.exe
Size

292KB
MD5

880a353dc9ab4202f2cfbec1cb37181d
SHA1

0bafee10ed68194fb332d3b46f7d92c8ad962843
SHA256

6b5c9cec68c7f3c0ba98b8d0b335f1be8ea4cd37fb02b4c81ecc1a95ef6d9578
SHA512

795db9946ac4bac6af4afcbd2e87671b45c488ea32d61daa821012f0213bde76af1d7ae395b9adfdc0fed5fd80367e232a6bc1d834e7dc9028b885fa908149d8
SSDEEP

6144:OWK8faaQMbjFtVNtHb7RGb/Mp7mgypysDVpU2drVxP:LaaQMXDFFfp7S5DbU2RP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	dxwsetup.exe

Loads dropped DLL 2 IoCs

pid	Process
332	dxwsetup.exe
332	dxwsetup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	dxwebsetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dxwebsetup.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\directx\websetup\SETA472.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SETA483.tmp	dxwsetup.exe
File created	C:\Windows\SysWOW64\directx\websetup\SETA483.tmp	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\dsetup32.dll	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\DirectX\WebSetup	dxwsetup.exe
File opened for modification	C:\Windows\SysWOW64\directx\websetup\SETA472.tmp	dxwsetup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	dxwsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 332	4596	dxwebsetup.exe	79
PID 4596 wrote to memory of 332	4596	dxwebsetup.exe	79
PID 4596 wrote to memory of 332	4596	dxwebsetup.exe	79

C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\dxwebsetup.exe
"C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\dxwebsetup.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll

Filesize
91KB

MD5
8dc08c0effffc3d08e8718260843d10c

SHA1
4b4fe49c563c01c8df1c8b0ecfd0008460a44cfe

SHA256
9ad6f392a736ba7e137ac7a49bc454e1457c91372ffec8effd4e779716a1f07d

SHA512
4698f40795e82ee01e2ef6ee2f168714b61cb4c702f2b8f9a66d804d0f37d2f6a6de68fd3669171f193da9eadf397f166d0a3f656682d4c19a990c1875ef08ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll

Filesize
1.6MB

MD5
f6b14958d2a93750c3d4fad02ca739be

SHA1
02e3592c5d45d4b72d42ce9378513c0d3a661b7b

SHA256
529c3e93c1a7cbb0225ab5f12c5bb0e91eb905ebf3db7fc00cbd96d8e66a6f0e

SHA512
377897d3aae1fceed8c9658800d7ffb05a855ec369b48b0709138122aaffdc9464a85abd214fbf93e9427a94b4ebee6e46a1ff34fc4b5ec54926c83c92ecd31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Filesize
476KB

MD5
a2772e5a8df5dc3487e8516321ed29da

SHA1
a0eee1c6115fb776bbba1a97d4ba7baa5511b310

SHA256
8fac859dc73ab7a8c18f093c6a58accf3ee8f1b86a4bcfce4c9e8a1253d2828f

SHA512
17ecff8ab8083318b40b1a38a6ae82b93937cddd8743aa07006e4b67f9d409e80885815fd756914810fb5e9504f0343e337004f09e9b51117e828962c8fae259

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

Filesize
476KB

MD5
a2772e5a8df5dc3487e8516321ed29da

SHA1
a0eee1c6115fb776bbba1a97d4ba7baa5511b310

SHA256
8fac859dc73ab7a8c18f093c6a58accf3ee8f1b86a4bcfce4c9e8a1253d2828f

SHA512
17ecff8ab8083318b40b1a38a6ae82b93937cddd8743aa07006e4b67f9d409e80885815fd756914810fb5e9504f0343e337004f09e9b51117e828962c8fae259

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf

Filesize
477B

MD5
ad8982eaa02c7ad4d7cdcbc248caa941

SHA1
4ccd8e038d73a5361d754c7598ed238fc040d16b

SHA256
d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00

SHA512
5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup.dll

Filesize
91KB

MD5
8dc08c0effffc3d08e8718260843d10c

SHA1
4b4fe49c563c01c8df1c8b0ecfd0008460a44cfe

SHA256
9ad6f392a736ba7e137ac7a49bc454e1457c91372ffec8effd4e779716a1f07d

SHA512
4698f40795e82ee01e2ef6ee2f168714b61cb4c702f2b8f9a66d804d0f37d2f6a6de68fd3669171f193da9eadf397f166d0a3f656682d4c19a990c1875ef08ae

Download Submit
C:\Windows\SysWOW64\directx\websetup\dsetup32.dll

Filesize
1.6MB

MD5
f6b14958d2a93750c3d4fad02ca739be

SHA1
02e3592c5d45d4b72d42ce9378513c0d3a661b7b

SHA256
529c3e93c1a7cbb0225ab5f12c5bb0e91eb905ebf3db7fc00cbd96d8e66a6f0e

SHA512
377897d3aae1fceed8c9658800d7ffb05a855ec369b48b0709138122aaffdc9464a85abd214fbf93e9427a94b4ebee6e46a1ff34fc4b5ec54926c83c92ecd31c

Download Submit