b13633b31e8704b63d977921d1c9a4284bfd4780c3f35a5bee372816d7beb005

Analysis

max time kernel
63s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2023, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
774f34a4c76cb6cc74e39124ae7684da.exe
Size 2.2MB
Sample230402-sblntagg92
SHA256 b13633b31e8704b63d977921d1c9a4284bfd4780c3f35a5bee372816d7beb005
MD5 774f34a4c76cb6cc74e39124ae7684da
SHA1 13afc4291b20736c7191ea99ca6370bf16a8d0ad
SHA512 dddf8ae468c991f052b901e715602c51415fa29714a329df5d9c58e895879d48cc14b825c687ef3754dd19385704d96444f408d584105ccb1b71dca0446d368e
SSDEEP 49152:pU2q08HdEFVwcQYTTekQ3YbF4tPKJ5pxP5SoNDGhg:dAlvCTWYbF9P5TDGh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4916	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	774f34a4c76cb6cc74e39124ae7684da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	774f34a4c76cb6cc74e39124ae7684da.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	4916	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe
4916	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3928	4284	774f34a4c76cb6cc74e39124ae7684da.exe	79
PID 4284 wrote to memory of 3928	4284	774f34a4c76cb6cc74e39124ae7684da.exe	79
PID 4284 wrote to memory of 3928	4284	774f34a4c76cb6cc74e39124ae7684da.exe	79
PID 3928 wrote to memory of 4916	3928	cmd.exe	81
PID 3928 wrote to memory of 4916	3928	cmd.exe	81
PID 3928 wrote to memory of 4916	3928	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\774f34a4c76cb6cc74e39124ae7684da.exe
"C:\Users\Admin\AppData\Local\Temp\774f34a4c76cb6cc74e39124ae7684da.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bimjbrkx.bat 2551873814
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lrgknyoxdo.dat 2551873814
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 1256
      4⤵
      Program crash
      PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4916 -ip 4916
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bimjbrkx.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bimjbrkx.bat
Size 110B
SHA256 239aba953963b647ce9d1540c7d566f515e469f78064bec859e82fafe9f14fc8
MD5 993eb7c3855a6953df459df15aaa624e
SHA1 5395e9836844b80f457b602adca3cb865982a13c
SHA512 1fe13c4f802c73a29f2feae52097ff41aeb864963020a595b3803347eb7020ac5d7ed638d14f212d221395355b07236b78b71f2e8fa911dcf143c6f6ae395b9f
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

enpswerb.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\enpswerb.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

enpswerb.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\enpswerb.dat.1
Size 2B
SHA256 ccc8d02c8169fdaeaaa52f9c74dfa3e1238ac5d0e89bc35223d423517f8e2b2d
MD5 873e009ecf0ccec19b3570baf5e70305
SHA1 d68e129e2ac27d06de80d1b16c1c4c4f589523f1
SHA512 4e483d49046751b02d209650cd1d82df15a3a99a41036c60fb4a1318df61fb7b51236442e5ad1e3116249737721e9aa6717becba1b2ef1ddc4fece5fca756f7e
MD5 SHA1 SHA512

Submit Download

enpswerb.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\enpswerb.dat.2
Size 5.2MB
SHA256 476208c256cd4a02d786e1921955c3403f5daa393f8823eb54207211158d8634
MD5 81128d3275a25973f6d3890a7170916c
SHA1 cd843ece3d182a8c9c98f568745715dd5026e896
SHA512 59ac0665a85d0b11e2f45412477627c0b2aa53f2ebf550281c73f5735a2a50073f6e60cedc9e2092be075fb92426b37dbc6ca310b7a6844f9aeb6f750dc7193a
SSDEEP 49152:Y6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:YbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lrgknyoxdo.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lrgknyoxdo.dat
Size 524KB
SHA256 54b1b5d4b2e02d30f76e3f9ba9cd5687f6433ab08ac896fca815e4e9f5cef20f
MD5 32d3fcef2a1c3542aa934ba691090496
SHA1 47de24a57ebf98e1c4fa8615f5b0f9b8c4b8f1e6
SHA512 d5ea6031ff3b449e659b265383d2f2284563835a726b268fc9fa3a4f7197569d2e04f63bd532b92f9cd33b8df2ab14cf9173ffd69e0c188f2c1ef39b0b2b1d15
SSDEEP 12288:Q+SmnLiZOMy5Dr6jzmw+CO+iYdY9qGp2uadUrQaBQCuAMIBPb:VLoSI1+COBiY93p/QSQylb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4916-153-0x0000000006D00000-0x0000000006D01000-memory.dmp

Download

memory/4916-155-0x0000000034A00000-0x0000000034A01000-memory.dmp

Download

memory/4916-156-0x0000000034F00000-0x0000000034F01000-memory.dmp

Download

memory/4916-157-0x0000000014F00000-0x0000000014F01000-memory.dmp

Download

memory/4916-158-0x000000002DF00000-0x000000002DF01000-memory.dmp

Download

memory/4916-154-0x0000000014800000-0x0000000014801000-memory.dmp

Download