Analysis
-
max time kernel
351s -
max time network
432s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 03:05
Static task
static1
Behavioral task
behavioral1
Sample
6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe
Resource
win10v2004-20230221-en
General
-
Target
6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe
-
Size
1.3MB
-
MD5
b2a5d3059feddcf5aa6bc72019a0ecbf
-
SHA1
e881e8238947dd3fba6f5f96626fcf113d5bb783
-
SHA256
6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86
-
SHA512
585dd3d7da710cdb600d0c5116c07fd71f52a306f65976072dcfdf4a5dc6ec0b76556bbc65ef696355ffd64dcd6dad854ad28f24328847e44905d4aef6fd77ca
-
SSDEEP
24576:pyFE94xiOVOFwp9Y9DLgLx5LCtiZsbuHRWzGgTN3bDTH9fSWQJjIaqAIQX3214se:cFuQ3VBIDLyutoYiUrBglSV
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
za608464.exeza507959.exeza965634.exe02174376.exepid process 2676 za608464.exe 3252 za507959.exe 1564 za965634.exe 2440 02174376.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exeza608464.exeza507959.exeza965634.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za608464.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" za608464.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za507959.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" za507959.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce za965634.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" za965634.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
02174376.exedescription pid process Token: SeDebugPrivilege 2440 02174376.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exeza608464.exeza507959.exeza965634.exedescription pid process target process PID 1388 wrote to memory of 2676 1388 6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe za608464.exe PID 1388 wrote to memory of 2676 1388 6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe za608464.exe PID 1388 wrote to memory of 2676 1388 6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe za608464.exe PID 2676 wrote to memory of 3252 2676 za608464.exe za507959.exe PID 2676 wrote to memory of 3252 2676 za608464.exe za507959.exe PID 2676 wrote to memory of 3252 2676 za608464.exe za507959.exe PID 3252 wrote to memory of 1564 3252 za507959.exe za965634.exe PID 3252 wrote to memory of 1564 3252 za507959.exe za965634.exe PID 3252 wrote to memory of 1564 3252 za507959.exe za965634.exe PID 1564 wrote to memory of 2440 1564 za965634.exe 02174376.exe PID 1564 wrote to memory of 2440 1564 za965634.exe 02174376.exe PID 1564 wrote to memory of 2440 1564 za965634.exe 02174376.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe"C:\Users\Admin\AppData\Local\Temp\6b4b0e450aaf93ad2d490dd145ee648ae03b40ef83dd3d5594213ea940eeff86.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exeFilesize
1.2MB
MD5b3ef537c9bb941d6f6a568706fc7be9d
SHA1b76060e52787dd05dca149bdad6f004e0a8ab8c9
SHA256e07c65a9bed54c40c6ffcb860901ba35035d0b00cfd50fdff465d866d5f6c624
SHA5127cdcd4985d482a8ecf208ab532ae2057941d8c5d373ab3ea79384590e99efe80b9d5af868ab2ffcc04f45d15593d91df2e6a9633d81f9ab1d6cd46619a60f1f0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za608464.exeFilesize
1.2MB
MD5b3ef537c9bb941d6f6a568706fc7be9d
SHA1b76060e52787dd05dca149bdad6f004e0a8ab8c9
SHA256e07c65a9bed54c40c6ffcb860901ba35035d0b00cfd50fdff465d866d5f6c624
SHA5127cdcd4985d482a8ecf208ab532ae2057941d8c5d373ab3ea79384590e99efe80b9d5af868ab2ffcc04f45d15593d91df2e6a9633d81f9ab1d6cd46619a60f1f0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exeFilesize
738KB
MD536f11a86bdf2a1575761005939aa1a87
SHA157a77fec4b189beaab4361dfb339ec3b99e2a19c
SHA256506b92485a70ce1083236c0006004dde0159c0f30e9caac92b640ea32ec3a118
SHA512e4ca70220aa6e987b2050490122de0a31d4d9a731f596ce1feab339b42a7a63e6d0a7611b850401fcc5b4b89277b96b0495e97c711e7335c3d21145c64508b80
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za507959.exeFilesize
738KB
MD536f11a86bdf2a1575761005939aa1a87
SHA157a77fec4b189beaab4361dfb339ec3b99e2a19c
SHA256506b92485a70ce1083236c0006004dde0159c0f30e9caac92b640ea32ec3a118
SHA512e4ca70220aa6e987b2050490122de0a31d4d9a731f596ce1feab339b42a7a63e6d0a7611b850401fcc5b4b89277b96b0495e97c711e7335c3d21145c64508b80
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exeFilesize
555KB
MD5a60498e286698e03bc8c23d3bf184b2e
SHA1aa40de169c13039c3bb75dc7f00ddd05bff23efb
SHA25699adff2346ec29d751c0c75f897bf53231e15f02e6f409d65a3fceb6c513accb
SHA5122f3994b5f73fdb571c192e620a0e8addab6a88967d30366b92000a0239069676b9575005950442cb1e07108bc00b4e3193c6c7a6e0471d807c708e8d8d98ca57
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za965634.exeFilesize
555KB
MD5a60498e286698e03bc8c23d3bf184b2e
SHA1aa40de169c13039c3bb75dc7f00ddd05bff23efb
SHA25699adff2346ec29d751c0c75f897bf53231e15f02e6f409d65a3fceb6c513accb
SHA5122f3994b5f73fdb571c192e620a0e8addab6a88967d30366b92000a0239069676b9575005950442cb1e07108bc00b4e3193c6c7a6e0471d807c708e8d8d98ca57
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exeFilesize
303KB
MD572e992838821425176065199ae3a092c
SHA1369077f94ab629ff7412c84302aa975e227b3b96
SHA256625ce2ba9ff4d599975c5643b72b3a24e6194a65fca7d876d9c71fdaa13692b5
SHA512ec96555550e975796e84128d3f3ffd93bdf557513baaab90607be30712d6939a755d73a9e341a93f3204c455a522fb085709e0fb8e85d19819a6be172d3e6713
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\02174376.exeFilesize
303KB
MD572e992838821425176065199ae3a092c
SHA1369077f94ab629ff7412c84302aa975e227b3b96
SHA256625ce2ba9ff4d599975c5643b72b3a24e6194a65fca7d876d9c71fdaa13692b5
SHA512ec96555550e975796e84128d3f3ffd93bdf557513baaab90607be30712d6939a755d73a9e341a93f3204c455a522fb085709e0fb8e85d19819a6be172d3e6713
-
memory/2440-161-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2440-162-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2440-163-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2440-164-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2440-165-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2440-166-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/2440-167-0x0000000004AD0000-0x0000000005074000-memory.dmpFilesize
5.6MB
-
memory/2440-168-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-169-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-171-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-173-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-175-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-177-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-179-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-181-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-183-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-185-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-187-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-189-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-191-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-193-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-195-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-197-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-199-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-201-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-203-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-205-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-213-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-211-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-209-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-207-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-215-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-217-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-219-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-221-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-223-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-225-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-227-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-229-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB
-
memory/2440-231-0x0000000001F30000-0x0000000001F81000-memory.dmpFilesize
324KB