0bdaa27e390c5e15c3b27ae4f4168fbf97693f5d03fa0f70487c63c13030ffd8

Analysis

max time kernel
77s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b52d4d8bce16a8f4165a8c8bf6844eb1.exe
Size 2.1MB
Sample230306-hal8vaad9v
SHA256 0bdaa27e390c5e15c3b27ae4f4168fbf97693f5d03fa0f70487c63c13030ffd8
MD5 b52d4d8bce16a8f4165a8c8bf6844eb1
SHA1 f93989a4d3d83e67a970edda112f33c824e330df
SHA512 75c6ab327729a0afc982fa696bb4e89e4e87752565642ee6d858d2e1a42867184733ddc2a844af43e2a5c04f43ee7742f96fcb0e76eb7b21dcf6e92e470d4d62
SSDEEP 24576:6yDKBzT7QsrNwEvon+K/VNvAaNywOobdieEqyyXUDOi294YohFDVfmgV+uzYxh1/:B+BzT7Fhwq8HbETfDpeFgV+ph1TjRXw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2540	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b52d4d8bce16a8f4165a8c8bf6844eb1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b52d4d8bce16a8f4165a8c8bf6844eb1.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	2540	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2540	conhost.exe
2540	conhost.exe
2540	conhost.exe
2540	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 3988	1428	b52d4d8bce16a8f4165a8c8bf6844eb1.exe	86
PID 1428 wrote to memory of 3988	1428	b52d4d8bce16a8f4165a8c8bf6844eb1.exe	86
PID 1428 wrote to memory of 3988	1428	b52d4d8bce16a8f4165a8c8bf6844eb1.exe	86
PID 3988 wrote to memory of 2540	3988	cmd.exe	88
PID 3988 wrote to memory of 2540	3988	cmd.exe	88
PID 3988 wrote to memory of 2540	3988	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\b52d4d8bce16a8f4165a8c8bf6844eb1.exe
"C:\Users\Admin\AppData\Local\Temp\b52d4d8bce16a8f4165a8c8bf6844eb1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bfcbyhyg.bat 297027421
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lcllfeokq.dat 297027421
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 1256
      4⤵
      Program crash
      PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2540 -ip 2540
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfcbyhyg.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bfcbyhyg.bat
Size 112B
SHA256 fd8b782ddb15a3e9fc84263dfeafc9cdbf2d2a625065e95633dc0edd5314cfc5
MD5 e1f73e6dde825bdebfa8ed3890c5c7e3
SHA1 085bb090ec82b0d1bb117cfe3af9363ecebf56df
SHA512 fb46867e46c5cb201129a59c0c839d9359b82d39bf5edd6d3aadcace621153a19e0c2be9229c40df4640c7fe8327624ba4c13dc67e3708261a696d586aca045d
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

edsnzxvsf.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\edsnzxvsf.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

edsnzxvsf.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\edsnzxvsf.dat.1
Size 2B
SHA256 ccc8d02c8169fdaeaaa52f9c74dfa3e1238ac5d0e89bc35223d423517f8e2b2d
MD5 873e009ecf0ccec19b3570baf5e70305
SHA1 d68e129e2ac27d06de80d1b16c1c4c4f589523f1
SHA512 4e483d49046751b02d209650cd1d82df15a3a99a41036c60fb4a1318df61fb7b51236442e5ad1e3116249737721e9aa6717becba1b2ef1ddc4fece5fca756f7e
MD5 SHA1 SHA512

Submit Download

edsnzxvsf.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\edsnzxvsf.dat.2
Size 5.2MB
SHA256 476208c256cd4a02d786e1921955c3403f5daa393f8823eb54207211158d8634
MD5 81128d3275a25973f6d3890a7170916c
SHA1 cd843ece3d182a8c9c98f568745715dd5026e896
SHA512 59ac0665a85d0b11e2f45412477627c0b2aa53f2ebf550281c73f5735a2a50073f6e60cedc9e2092be075fb92426b37dbc6ca310b7a6844f9aeb6f750dc7193a
SSDEEP 49152:Y6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:YbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lcllfeokq.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lcllfeokq.dat
Size 358KB
SHA256 c786fb77aba0b41e1b09628a1aa49dad5d33ce16dccfaa43385bd0bc484bc5aa
MD5 f79852151add2df083a5cc3cc461e551
SHA1 d88547a71c1fd02f604bc93360b3e33630678601
SHA512 a91556f2ee8147aaa3db7f1b1e41dcab7cfaaf81a6c0f217accaec0ca083f8683eec6d2d9b8511205299cddf6401e13c289444ce89f74c44b89d6081576278e5
SSDEEP 6144:rkOd3dJsZpiEQNRsdVSh/h5ZqCly8G2O2IvBTPgOmD6ou87OVIp7hTf:rkGpEQ2VwACl1QBTbhYOA7hTf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2540-158-0x000000001DA00000-0x000000001DA01000-memory.dmp

Download

memory/2540-157-0x000000003EF00000-0x000000003EF01000-memory.dmp

Download

memory/2540-156-0x000000000FC00000-0x000000000FC01000-memory.dmp

Download

memory/2540-155-0x000000001FC00000-0x000000001FC01000-memory.dmp

Download

memory/2540-154-0x000000001D100000-0x000000001D101000-memory.dmp

Download

memory/2540-153-0x000000000F700000-0x000000000F701000-memory.dmp

Download