8b3915b52f03e8a23c59146ceb7f9d50b0a59e466c2c4e1f3ac3e7875106350e

Analysis

max time kernel
110s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2023, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e5d50b16a7a4fc899525098c89a4445.exe
Size 2.2MB
Sample230331-gpqn5sgf76
SHA256 8b3915b52f03e8a23c59146ceb7f9d50b0a59e466c2c4e1f3ac3e7875106350e
MD5 0e5d50b16a7a4fc899525098c89a4445
SHA1 2356fe31f49ddf1919bf6f2cc57bcb03714c7e7e
SHA512 eeb32fce1fdbcafc51292f42c5da81b83c6a02e8001742cd7507218b86a4522fcc6ab336bbf2360d3b195c127856025bbe0feef98fef2e5ecf27626bb9f4f522
SSDEEP 49152:590HYKaYysNLxZFNxvyw30i7YTBxxFTPDVwzl:nWYwPN9ZDv0i7U7TPDVwzl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
792	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0e5d50b16a7a4fc899525098c89a4445.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0e5d50b16a7a4fc899525098c89a4445.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3684	792	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
792	conhost.exe
792	conhost.exe
792	conhost.exe
792	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4300	3824	0e5d50b16a7a4fc899525098c89a4445.exe	84
PID 3824 wrote to memory of 4300	3824	0e5d50b16a7a4fc899525098c89a4445.exe	84
PID 3824 wrote to memory of 4300	3824	0e5d50b16a7a4fc899525098c89a4445.exe	84
PID 4300 wrote to memory of 792	4300	cmd.exe	86
PID 4300 wrote to memory of 792	4300	cmd.exe	86
PID 4300 wrote to memory of 792	4300	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\0e5d50b16a7a4fc899525098c89a4445.exe
"C:\Users\Admin\AppData\Local\Temp\0e5d50b16a7a4fc899525098c89a4445.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bhrbaqft.bat 35502511
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lwxogvpn.dat 35502511
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 1272
      4⤵
      Program crash
      PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 792 -ip 792
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bhrbaqft.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bhrbaqft.bat
Size 117B
SHA256 cabc763166de7095c11ce9bafd3b1dfe81289d1e2751c32a44588b0cfcb6061c
MD5 ae81047d88b48364cb846b135989386a
SHA1 3257cda20b506df47178a987a84d34cf39776ae6
SHA512 f684cf3326098557d1c2d50c326f1e69e14f7a0cb78ed443047153a803f0d0e24b8a9bf8ffe15fd7f403a9096377e32bd770c47cae37ecec757563b6ac2f261c
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

eyaycjtcpvk.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eyaycjtcpvk.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

eyaycjtcpvk.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eyaycjtcpvk.dat.1
Size 2B
SHA256 ccc8d02c8169fdaeaaa52f9c74dfa3e1238ac5d0e89bc35223d423517f8e2b2d
MD5 873e009ecf0ccec19b3570baf5e70305
SHA1 d68e129e2ac27d06de80d1b16c1c4c4f589523f1
SHA512 4e483d49046751b02d209650cd1d82df15a3a99a41036c60fb4a1318df61fb7b51236442e5ad1e3116249737721e9aa6717becba1b2ef1ddc4fece5fca756f7e
MD5 SHA1 SHA512

Submit Download

eyaycjtcpvk.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eyaycjtcpvk.dat.2
Size 5.2MB
SHA256 476208c256cd4a02d786e1921955c3403f5daa393f8823eb54207211158d8634
MD5 81128d3275a25973f6d3890a7170916c
SHA1 cd843ece3d182a8c9c98f568745715dd5026e896
SHA512 59ac0665a85d0b11e2f45412477627c0b2aa53f2ebf550281c73f5735a2a50073f6e60cedc9e2092be075fb92426b37dbc6ca310b7a6844f9aeb6f750dc7193a
SSDEEP 49152:Y6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:YbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lwxogvpn.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lwxogvpn.dat
Size 515KB
SHA256 121cef0546ab6319f7c4b112f6d85d4d7029ed1415014f00bd19d56bb6d7c561
MD5 fab0bc7067d7f050ce251fa494a3bf6c
SHA1 c4578648088e59b2d8c6b128c0adebb53634f6be
SHA512 451fd18075a0071da13c763d02b98291aa0e605061edddf69faa595360ddc04847c06f21264d342fc507ae6640fc7cc4f6a501ed9ffdf7334356124ba80df471
SSDEEP 12288:/rDHDqtzwhgyHZZqg6ojX1r4j6i8qJ67TIxm:/rTu5wZygsuEJi4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/792-153-0x0000000017400000-0x0000000017401000-memory.dmp

Download

memory/792-156-0x000000000D600000-0x000000000D601000-memory.dmp

Download

memory/792-155-0x000000002C400000-0x000000002C401000-memory.dmp

Download

memory/792-157-0x000000002F100000-0x000000002F101000-memory.dmp

Download

memory/792-158-0x000000000DE00000-0x000000000DE01000-memory.dmp

Download

memory/792-154-0x000000001E100000-0x000000001E101000-memory.dmp

Download