28eb3941dee1a78351ee18596be6445d4fb10332d002f85aee675f672cf2fd1c

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2023, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.5MB
Sample230620-gtrf8sbd3t
SHA256 28eb3941dee1a78351ee18596be6445d4fb10332d002f85aee675f672cf2fd1c
MD5 95ca2d5c4466b235b59193ddbccd9166
SHA1 dce67bf20b81c1c26e27b4c6e98fd4a3635a0bc7
SHA512 1ce867662ea1af5c902cd458c9aa84c9f94feb83ba8b9076cc415e7e0e28b7567583fd4fd00b1b9faa0494309c5091cf0005149943f8d2236ce9e063ca12354d
SSDEEP 49152:63zJVxwtN9oNSzWmDjfs4DI0gAF9xvCw/snQfbJAz8naQGPtNJ:OJVk3DT5g2UQzOz8JOtNJ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2592	fowrnokp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
228	2592	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2592	fowrnokp.exe
2592	fowrnokp.exe
2592	fowrnokp.exe
2592	fowrnokp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1860	2076	file.exe	84
PID 2076 wrote to memory of 1860	2076	file.exe	84
PID 2076 wrote to memory of 1860	2076	file.exe	84
PID 1860 wrote to memory of 2592	1860	cmd.exe	86
PID 1860 wrote to memory of 2592	1860	cmd.exe	86
PID 1860 wrote to memory of 2592	1860	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /d /c bxtmqcsqd.bat 1933975811
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fowrnokp.exe
    fowrnokp.exe lddlxaam.dat 1933975811
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 1280
      4⤵
      Program crash
      PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2592 -ip 2592
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bxtmqcsqd.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bxtmqcsqd.bat
Size 127B
SHA256 38934d53b5cc61cb4e2780f574d8fe297ccab5c3e59e35928a70ed8098e9cde1
MD5 34542e944862eb1f3c3469ccf563fc3d
SHA1 bb614c0b9a144645b011eb8a83285f7ce46af277
SHA512 d09bcdf0ea96c57a74a0ce251aaff36f3d1af34be0f5fbc14f1cbf2ac5acd5884990e68d9862049bbb69ee17c4830b2f6cbdf133b8f0621ee045ac7b04f57b4a
MD5 SHA1 SHA512

Submit Download

esieeqqi.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esieeqqi.dat
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

esieeqqi.dat.1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esieeqqi.dat.1
Size 3B
SHA256 39561f8af034137905f14ca7fd5a2c891bc12982f3f8ef2271e75e93433ffa90
MD5 158b365b9eedcfaf539f5dedfd82ee97
SHA1 529f5d61ac99f60a8e473368eff1b32095a3e2bf
SHA512 a1b231c2e6af432ee7df82e00d568819e12149af707d4c4fdd018b38cc4f9761062c5b7e497bd1b67e466b89e391520b88bf13f18c8b9ff646d82df740c05c09
MD5 SHA1 SHA512

Submit Download

esieeqqi.dat.2

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esieeqqi.dat.2
Size 33B
SHA256 4ebc21177ee9907f71a1641a0482603ced98e9d43389cac0ffb0b59f7343eeba
MD5 500ba63e2664798939744b8a8c9be982
SHA1 54743a77e4186cb327b803efb1ef5b3d4ac163ce
SHA512 9992b70de5867e2a00aff4f79c37ba71e827cbb104c192ebd4a553f91ae06a5b235f34e65d9d1145591c147e9e6726146cb92171945aa67b8f3294116a223fe7
MD5 SHA1 SHA512

Submit Download

esieeqqi.dat.3

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esieeqqi.dat.3
Size 5.2MB
SHA256 088a5d04f2f6d6820bf1a6a390d9c0e00f88896c932848f0c97912b861479bb9
MD5 a452946137958e0cee844310f9e9fa7c
SHA1 8cf21ae4d1d764154048a02fb49412ef94094485
SHA512 ef3759e134c9b0eaaf300a57d335131faa91337497f572ef7eb1058e498a071d1741a6e0947ca9e95fe92b1ca163814ce6d1d706ad5ab010d47d18038b26beaa
SSDEEP 49152:WFlKjoqMGbkf8XfH2cvoJ7JdCrM5faRYZs9rri9/F0U2cRP8JF9zdP+T1E6gpPyV:WFlJqM48QunJ7JkA5faRO/06EnRyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

fowrnokp.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fowrnokp.exe
Size 5.2MB
SHA256 9c5898b1b354b139794f10594e84e94e991971a54d179b2e9f746319ffac56aa
MD5 812d99a3d89b8de1b866ac960031e3df
SHA1 6817df1da376e8f6e68fd1ad06d78f02406b6e19
SHA512 85f72df2e679da3f337fc162ce3023d7d078c4433b49d3f4a16946fb0d2fdbadf5c736ff76e47bcdf920d5d90e05bf7f66ec9ca9fbe3f1d620cf33c046d857e7
SSDEEP 49152:eFlKjoqMGbkf8XfH2cvoJ7JdCrM5faRYZs9rri9/F0U2cRP8JF9zdP+T1E6gpPyV:eFlJqM48QunJ7JkA5faRO/06EnRyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

fowrnokp.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fowrnokp.exe
Size 5.2MB
SHA256 9c5898b1b354b139794f10594e84e94e991971a54d179b2e9f746319ffac56aa
MD5 812d99a3d89b8de1b866ac960031e3df
SHA1 6817df1da376e8f6e68fd1ad06d78f02406b6e19
SHA512 85f72df2e679da3f337fc162ce3023d7d078c4433b49d3f4a16946fb0d2fdbadf5c736ff76e47bcdf920d5d90e05bf7f66ec9ca9fbe3f1d620cf33c046d857e7
SSDEEP 49152:eFlKjoqMGbkf8XfH2cvoJ7JdCrM5faRYZs9rri9/F0U2cRP8JF9zdP+T1E6gpPyV:eFlJqM48QunJ7JkA5faRO/06EnRyI
MD5 SHA1 SHA512 SSDEEP

Submit Download

lddlxaam.dat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lddlxaam.dat
Size 939KB
SHA256 243b0bf7d114c56fb91b8dda3c0473e5e2bb94e66fe2f9e58e826a22f85110d3
MD5 4bccfd10c313eea1442664ab90d90d45
SHA1 9fdec67058626c4cc0eb3583e287cd7a5cac1963
SHA512 53cc09f218b3c2029265243bdd761ae038e9d54d5786c14807b9c2171a8014773f0cc3f1c6b7b001b3cb8c6f04289d1d0885610b2e6b14a95247a3f0b316582b
SSDEEP 24576:wqLKmVCE5P7jdnu203A+A+WnKG2pEpi6QTO:LjlDKGkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2592-156-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/2592-158-0x0000000005200000-0x0000000005201000-memory.dmp

Download

memory/2592-157-0x0000000024900000-0x0000000024901000-memory.dmp

Download

memory/2592-159-0x0000000026A00000-0x0000000026A01000-memory.dmp

Download

memory/2592-160-0x000000001EA00000-0x000000001EA01000-memory.dmp

Download

memory/2592-161-0x000000002DD00000-0x000000002DD01000-memory.dmp

Download