Analysis
-
max time kernel
244s -
max time network
276s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2023 18:21
Static task
static1
Behavioral task
behavioral1
Sample
c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe
Resource
win10v2004-20230221-en
General
-
Target
c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe
-
Size
1.2MB
-
MD5
06ac4261787d152ab6d4bba12ee1769f
-
SHA1
b9ed6f8ea9d6bb27961ddf310f267bcb4e27edb2
-
SHA256
c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9
-
SHA512
d54630c9d4d6c5f4bc5ade31e46c329424c06c551c4b3eb9d9fa0699202b9d446375f8b34791156e2926e2b451868943568f23584cb1cab92fd8f277e402b938
-
SSDEEP
24576:6yjdxhnJlFh+oFwf5DpGhhoNJs31mFGqC6P4mVPIZqGvdMfcT:BpxhnJd+oif5e2NS31mUqC6PNI
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
z12857891.exez36906253.exez76317375.exes14545389.exepid process 3912 z12857891.exe 2372 z36906253.exe 5028 z76317375.exe 4872 s14545389.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exez12857891.exez36906253.exez76317375.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z12857891.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z12857891.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z36906253.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z36906253.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z76317375.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z76317375.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exez12857891.exez36906253.exez76317375.exedescription pid process target process PID 1356 wrote to memory of 3912 1356 c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe z12857891.exe PID 1356 wrote to memory of 3912 1356 c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe z12857891.exe PID 1356 wrote to memory of 3912 1356 c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe z12857891.exe PID 3912 wrote to memory of 2372 3912 z12857891.exe z36906253.exe PID 3912 wrote to memory of 2372 3912 z12857891.exe z36906253.exe PID 3912 wrote to memory of 2372 3912 z12857891.exe z36906253.exe PID 2372 wrote to memory of 5028 2372 z36906253.exe z76317375.exe PID 2372 wrote to memory of 5028 2372 z36906253.exe z76317375.exe PID 2372 wrote to memory of 5028 2372 z36906253.exe z76317375.exe PID 5028 wrote to memory of 4872 5028 z76317375.exe s14545389.exe PID 5028 wrote to memory of 4872 5028 z76317375.exe s14545389.exe PID 5028 wrote to memory of 4872 5028 z76317375.exe s14545389.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe"C:\Users\Admin\AppData\Local\Temp\c8c6b1ae5f636e9e440b8697cd25f1e94d6a3ad6a243a407830e8d35f8596fe9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z12857891.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z12857891.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z36906253.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z36906253.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z76317375.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z76317375.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14545389.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14545389.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z12857891.exeFilesize
1.0MB
MD5802449a7af720a14b2fdb4ca46f1f80e
SHA10bfa9cbb3eec29a80edc806471ead96ee9a4f9d9
SHA256ba602dd0012564d9d94ee58bc572d710540303bb86c4db242610a7419e1f6a41
SHA5125911e693d022c9f5e0ed374d23071cfce0826fdcedac15f99b39acb5e69994123909927784f58e229550596feef0e5f75286d70c4e7e2bf08af0e760e854e468
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z12857891.exeFilesize
1.0MB
MD5802449a7af720a14b2fdb4ca46f1f80e
SHA10bfa9cbb3eec29a80edc806471ead96ee9a4f9d9
SHA256ba602dd0012564d9d94ee58bc572d710540303bb86c4db242610a7419e1f6a41
SHA5125911e693d022c9f5e0ed374d23071cfce0826fdcedac15f99b39acb5e69994123909927784f58e229550596feef0e5f75286d70c4e7e2bf08af0e760e854e468
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z36906253.exeFilesize
752KB
MD5ee4cb7bb555e790b5243766150c0589a
SHA1525151b960b2a94e18d3956333c63686d8d93335
SHA2569f66dbb8dc8788f2bc57deba7b18c04fe6328117a28e8b05d8f46c8626c47a6d
SHA512a665003e9c5adc06fcda6d60962fb99cec3dce9538565b9acff207b573c80dddb5f041b1ac349b9aaf7385cccc58ff5df26f49b4cfce20e80b11a77ca0e416ba
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z36906253.exeFilesize
752KB
MD5ee4cb7bb555e790b5243766150c0589a
SHA1525151b960b2a94e18d3956333c63686d8d93335
SHA2569f66dbb8dc8788f2bc57deba7b18c04fe6328117a28e8b05d8f46c8626c47a6d
SHA512a665003e9c5adc06fcda6d60962fb99cec3dce9538565b9acff207b573c80dddb5f041b1ac349b9aaf7385cccc58ff5df26f49b4cfce20e80b11a77ca0e416ba
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z76317375.exeFilesize
569KB
MD588fe3f6af596c0ce031d695273d6be59
SHA1359dcddd6583163f630f2ee5766f9340b265616d
SHA256df6c518bde494b0b12ce42c2b3f444c3e33f08394c9f244d22890456bf23225a
SHA5128f101cd161d1e8cbef1cffe711bed0dd95879d5806c4e86057e5a7026bc632135038cde8d263b730167686872d653b2ca661aea71ea04ee986e16fa4bc566122
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z76317375.exeFilesize
569KB
MD588fe3f6af596c0ce031d695273d6be59
SHA1359dcddd6583163f630f2ee5766f9340b265616d
SHA256df6c518bde494b0b12ce42c2b3f444c3e33f08394c9f244d22890456bf23225a
SHA5128f101cd161d1e8cbef1cffe711bed0dd95879d5806c4e86057e5a7026bc632135038cde8d263b730167686872d653b2ca661aea71ea04ee986e16fa4bc566122
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14545389.exeFilesize
488KB
MD5a4502148df3fef68f8a24301188a8924
SHA1811339fde3685eccc95a9f869e475793f95f2a2d
SHA25698895df40ff3cb9418f18bfe19d11533bf86fcdf910c2803e0bc4fe37ca10c2e
SHA5121b6c281b17216738e41bb7fcb62a1d0a604ac3a8459410478c841e78dd9974528bfc6f510be40290884ea923a30f2b93a289759e2e1aee82659f43ea6b480e1d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s14545389.exeFilesize
488KB
MD5a4502148df3fef68f8a24301188a8924
SHA1811339fde3685eccc95a9f869e475793f95f2a2d
SHA25698895df40ff3cb9418f18bfe19d11533bf86fcdf910c2803e0bc4fe37ca10c2e
SHA5121b6c281b17216738e41bb7fcb62a1d0a604ac3a8459410478c841e78dd9974528bfc6f510be40290884ea923a30f2b93a289759e2e1aee82659f43ea6b480e1d
-
memory/4872-162-0x0000000000400000-0x0000000000820000-memory.dmpFilesize
4.1MB
-
memory/4872-163-0x00000000008F0000-0x000000000094B000-memory.dmpFilesize
364KB