5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982

Resubmissions

15/05/2023, 04:15

230515-evkzqsha6s 6

15/05/2023, 03:53

230515-ef2nyaef64 6

Analysis

max time kernel
57s
max time network
180s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
15/05/2023, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe
Size

209KB
MD5

508bd7adb8979cb793d0770ccf30b532
SHA1

34e00766ec558163daa6d4c6db33197b410bb78a
SHA256

5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982
SHA512

c409d2c011497af79394285c4415c21e68db4c2a5ea90145ade11d29eda22c05d501fc618c801679f9d04954dd09cc349b174b591f94250097bdc60982377a4d
SSDEEP

3072:HeFJv/HExrlEdPg65om1U15UF7RgUyH3alTbxI:+Tv/HKlEdP3hIU5Cha8

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\SemenExe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Compot.exe"	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4404 set thread context of 1320	4404	5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe	67

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1320	4404	5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe	67
PID 4404 wrote to memory of 1320	4404	5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe	67
PID 4404 wrote to memory of 1320	4404	5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe	67
PID 4404 wrote to memory of 1320	4404	5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe	67
PID 4404 wrote to memory of 1320	4404	5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe	67

C:\Users\Admin\AppData\Local\Temp\5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe
"C:\Users\Admin\AppData\Local\Temp\5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-122-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1320-130-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download