2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856

Analysis

max time kernel
233s
max time network
315s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2023, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe
Size

611KB
MD5

40fef9db85c4bd9941905113d17220f1
SHA1

fb9d798950b09ed313821731ec6e3af30600df3d
SHA256

2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856
SHA512

f82468c24cd16a837757b36c2a383b4f13680356a1a05f69086fde867775a485f508a43aa59fa92dd8e9b8daf4d38ca81159860c2a8050c0e1dbbbcad0d7c523
SSDEEP

12288:Ny90C4nGTNMqnPYEDGCI0fbfkz6uyTfmpYn8w19+iWpC:NyjaGTBP5GC7bfq6uyTfmen7H+m

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3084	st141334.exe
3548	36328205.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	st141334.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	st141334.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3084	224	2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe	81
PID 224 wrote to memory of 3084	224	2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe	81
PID 224 wrote to memory of 3084	224	2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe	81
PID 3084 wrote to memory of 3548	3084	st141334.exe	82
PID 3084 wrote to memory of 3548	3084	st141334.exe	82

C:\Users\Admin\AppData\Local\Temp\2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe
"C:\Users\Admin\AppData\Local\Temp\2ab0367d10313392bce08b726fb68f8e6f313abcef6d805b66b42228220ec856.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st141334.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st141334.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\36328205.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\36328205.exe
    3⤵
    - Executes dropped EXE
    PID:3548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st141334.exe

Filesize
457KB

MD5
4b82536260cc102ca773aa71fe66a4eb

SHA1
4eae7adb37d7a9d1a5e63bac384d2c4fb6e3d011

SHA256
c6610b821638ada16fa9f8a760dbd63eae51320cb84a3495c85282c9628f1806

SHA512
7f8e27e7dc51b1ee0258de6455570c857d43d9b7ac2876090525a9b4296f7df8701c5bbea77d67d4fe0bc8c7a992a09d04b61ce94a89e245bf537732cc0a4876

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st141334.exe

Filesize
457KB

MD5
4b82536260cc102ca773aa71fe66a4eb

SHA1
4eae7adb37d7a9d1a5e63bac384d2c4fb6e3d011

SHA256
c6610b821638ada16fa9f8a760dbd63eae51320cb84a3495c85282c9628f1806

SHA512
7f8e27e7dc51b1ee0258de6455570c857d43d9b7ac2876090525a9b4296f7df8701c5bbea77d67d4fe0bc8c7a992a09d04b61ce94a89e245bf537732cc0a4876

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\36328205.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\36328205.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
memory/3548-147-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download