5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe
Size

754KB
MD5

eeb7a554818eaaa13ae39f02f54dd35b
SHA1

3050ce0aa70ab26e5593552dcaf30e61f92c72e9
SHA256

5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09
SHA512

672eb52ddb505ed7aac1b4e7f06effce99e236eb97907815c00906050f38ba3e0103eb46e9c6680116ed7b2b52b9470c8d680d706a86f7f484fa2383fd0e0a27
SSDEEP

6144:0Er4xHNGMGvlWLwPDvBjmydGcjBE+iufSV59qmHdnseNVGw7zANBESHqXhEnFu2o:0tHNGnvOwAyVdETufSz

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe"	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Serverx.exe	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe
File opened for modification	C:\Windows\SysWOW64\Serverx.exe	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2464	3012	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe	28
PID 3012 wrote to memory of 2464	3012	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe	28
PID 3012 wrote to memory of 2464	3012	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe	28
PID 3012 wrote to memory of 2464	3012	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe	28
PID 3012 wrote to memory of 1336	3012	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe	11
PID 3012 wrote to memory of 1336	3012	5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1336
- C:\Users\Admin\AppData\Local\Temp\5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe
  "C:\Users\Admin\AppData\Local\Temp\5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe
    "C:\Users\Admin\AppData\Local\Temp\5b731e3fd4cb11cd82977472252913ab3a93fa779f9c8ad9cd1050f87fb42b09.exe"
    3⤵
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-4-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1336-5-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2464-2-0x0000000000C10000-0x0000000000CD0658-memory.dmp

Filesize
769KB

Download
memory/3012-0-0x0000000000C10000-0x0000000000CD0658-memory.dmp

Filesize
769KB

Download
memory/3012-1-0x0000000000500000-0x00000000005C1000-memory.dmp

Filesize
772KB

Download
memory/3012-6-0x0000000000C10000-0x0000000000CD0658-memory.dmp

Filesize
769KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads