11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0

Resubmissions

13-06-2023 14:23

230613-rqmzragf66 10

13-06-2023 14:10

230613-rg3zlsge64 10

13-06-2023 02:06

230613-cjr8kafa5x 10

Analysis

max time kernel
397s
max time network
400s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-06-2023 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d872fbe973a4799e94f57abdc594b37e.exe
Size

475KB
MD5

d872fbe973a4799e94f57abdc594b37e
SHA1

b16837fd4ce58947536360e301e985c7d37d6b1c
SHA256

11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0
SHA512

772f155b664316993bfaa04f4fdf54d9f0b41f7a11ecb39bf7a9409f7afecf612f1ebdf2df7ef548b967291edee1e639d723b6e4c16fc0b36be414e45ac2d53f
SSDEEP

6144:w9TKnLFNE2Dg5PjGnBEYfzTFYIKwstHLzizUblgFBNc3d2RohDAF:w9TKDyxYfz5mwCH/iclgFBGNSoy

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 2000 powershell.exe
6 2000 powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2000 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2000 powershell.exe

flow	pid	process
4	2000	powershell.exe
6	2000	powershell.exe

pid	process
2000	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d872fbe973a4799e94f57abdc594b37e.exe

description	pid	process	target process
PID 1088 wrote to memory of 2000	1088	d872fbe973a4799e94f57abdc594b37e.exe	powershell.exe
PID 1088 wrote to memory of 2000	1088	d872fbe973a4799e94f57abdc594b37e.exe	powershell.exe
PID 1088 wrote to memory of 2000	1088	d872fbe973a4799e94f57abdc594b37e.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\d872fbe973a4799e94f57abdc594b37e.exe
"C:\Users\Admin\AppData\Local\Temp\d872fbe973a4799e94f57abdc594b37e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -F C:/ProgramData/md9fmn2uj52E8Ut8f5xmiH0j4abpph3A.ps1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\md9fmn2uj52E8Ut8f5xmiH0j4abpph3A.ps1

Filesize
23KB

MD5
d2e91c11db4839b18d3e90afc151709d

SHA1
53fdca35ab2eb30ca7ac9f6a2a4fa14523055ca6

SHA256
05c4f31e351d6e97164ec3a249d0c11f32323bcc1c77172c800ae2ac5fb3d8d4

SHA512
888122d0bb2b04edc854860a10729ba6724dcaa9c1867a899850b9809435a13147b95003d717252ba0daae888935f76467d585bec563364ab21698cdc225b008

Download Submit
memory/2000-59-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

Filesize
2.9MB

Download
memory/2000-61-0x0000000001F90000-0x0000000001F98000-memory.dmp

Filesize
32KB

Download
memory/2000-62-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/2000-63-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/2000-60-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download
memory/2000-65-0x0000000002760000-0x00000000027E0000-memory.dmp

Filesize
512KB

Download