bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb

Analysis

max time kernel
86s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2023, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
def9168d187f736cd5f73d0af24e6474.exe
Size 2.2MB
Sample230406-sdwa2afd8t
SHA256 bf5b770fa754d54c658f859e85873708b92b757179eb761629d0ea83f6d5f9cb
MD5 def9168d187f736cd5f73d0af24e6474
SHA1 80977ef96f1614b91366eb0ce7b3e8639a76338e
SHA512 0b1d2a74361a0022dd9a1ea8ad21ad0fc1bbe1337ddf0e187c019f0410a56826375c26642e147ba5a1d81e85a90f86472001e7d6ed564213fc7a87b6be035dd5
SSDEEP 49152:UnZoG2Q3waP1168eYIWE6EY/pZl9LaFNLnf27gYa5pu+0L:PG2QgaPb68eYI/Pv0L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2236	conhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	def9168d187f736cd5f73d0af24e6474.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	def9168d187f736cd5f73d0af24e6474.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	2236	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2236	conhost.exe
2236	conhost.exe
2236	conhost.exe
2236	conhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 452	2680	def9168d187f736cd5f73d0af24e6474.exe	84
PID 2680 wrote to memory of 452	2680	def9168d187f736cd5f73d0af24e6474.exe	84
PID 2680 wrote to memory of 452	2680	def9168d187f736cd5f73d0af24e6474.exe	84
PID 452 wrote to memory of 2236	452	cmd.exe	86
PID 452 wrote to memory of 2236	452	cmd.exe	86
PID 452 wrote to memory of 2236	452	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\def9168d187f736cd5f73d0af24e6474.exe
"C:\Users\Admin\AppData\Local\Temp\def9168d187f736cd5f73d0af24e6474.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bfymssk.bat 93571972
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
    conhost.exe lyffuerogb.dat 93571972
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1264
      4⤵
      Program crash
      PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2236 -ip 2236
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bfymssk.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bfymssk.bat
Size 113B
SHA256 470de1692c4abe04f3e320765e2690d69ba050e944736958ddacee2e3a021f41
MD5 a7ab24702ebbd52ccec94869c7829964
SHA1 19ea34abb956ffffb63f45e9d25514ab839288f5
SHA512 acb652ae95f272b169d228aee071edc0eead4fea481f3f6da4e032ab81055585301339f144c2406c91229a47fc209e1bddf956b85272cffb7343f77d6a8bd081
MD5 SHA1 SHA512

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\conhost.exe
Size 5.2MB
SHA256 d08256e94e7f0006495f48f04bfde0f08fe57bb3d6f881ffd5d3e7382a437379
MD5 8037fcd47b0e6228e8a9a10cc27f5535
SHA1 b2f6ae6d348fce24a85623bf082819e90df07a05
SHA512 365e901156859b743fad1e89f035ae9d38be53d2ce60131328aebe630db62e67d059c76cba17dcb4a5c2601775638c078b0e57f10c86190039f60b3510267649
SSDEEP 49152:B6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:BbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

eiirqcgow.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eiirqcgow.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

eiirqcgow.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eiirqcgow.dat.1
Size 2B
SHA256 ccc8d02c8169fdaeaaa52f9c74dfa3e1238ac5d0e89bc35223d423517f8e2b2d
MD5 873e009ecf0ccec19b3570baf5e70305
SHA1 d68e129e2ac27d06de80d1b16c1c4c4f589523f1
SHA512 4e483d49046751b02d209650cd1d82df15a3a99a41036c60fb4a1318df61fb7b51236442e5ad1e3116249737721e9aa6717becba1b2ef1ddc4fece5fca756f7e
MD5 SHA1 SHA512

Submit Download

eiirqcgow.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eiirqcgow.dat.2
Size 5.2MB
SHA256 476208c256cd4a02d786e1921955c3403f5daa393f8823eb54207211158d8634
MD5 81128d3275a25973f6d3890a7170916c
SHA1 cd843ece3d182a8c9c98f568745715dd5026e896
SHA512 59ac0665a85d0b11e2f45412477627c0b2aa53f2ebf550281c73f5735a2a50073f6e60cedc9e2092be075fb92426b37dbc6ca310b7a6844f9aeb6f750dc7193a
SSDEEP 49152:Y6LMNBt572rwbF7qS0NzKSgXJz104r5LxlondBXipDjuFUTRRooPxUz56QBwRTjt:YbT7Owh0NzK/5z104r5JXwzwHRyIM2T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lyffuerogb.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lyffuerogb.dat
Size 559KB
SHA256 65782f35d7c3a3bfaa48fb6a0a103f8a98ebd0ed1aad9e08995bbcdd42d50125
MD5 22e4a48b65e561e3f3da06f7cdcc59ca
SHA1 d923135ce66923e247a79de2a1a603a683c79774
SHA512 291d88c3e08855ca531cd1e2b28915278d24437cfe8a9f4d988215f495eb335bf374a8393d7c0690fb76d574ca26efdeec8ea1989b25ecab5d3c6edc4a50d076
SSDEEP 12288:QrHxvH5UbOlEPtosb9GjlfOQenV9dCdoHTXC1llmg5o/Q1SbzaPzIfW4pU:QrHx3lE+o9GudCdSTXCP8g5n16UzIu4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2236-153-0x000000003CD00000-0x000000003CD01000-memory.dmp

Download

memory/2236-156-0x0000000026600000-0x0000000026601000-memory.dmp

Download

memory/2236-155-0x000000000C700000-0x000000000C701000-memory.dmp

Download

memory/2236-158-0x000000000C500000-0x000000000C501000-memory.dmp

Download

memory/2236-157-0x000000002F300000-0x000000002F301000-memory.dmp

Download

memory/2236-154-0x0000000034200000-0x0000000034201000-memory.dmp

Download