1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
Size

60KB
MD5

45b1f6b08b638607c986ae69b49fb6aa
SHA1

e3bdde86d74c49fe509973433682e45a297cbfc1
SHA256

9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909
SHA512

da41008b77cdf32f1585ad1d0ebf9855d2fea30e50fb167c493202665b6e43f0eb7b5c2e8264e8fbf5d3c73ab1142c5cf0721a24a24ddcfc04b9d04aa66760c7
SSDEEP

768:51lmUVT0rOklf9uBcCmD6gwZ8E1g508AFN63Lul5b92SOjbxR1sWh7vZPrONK5:n2akOcvs8SiLul5Zmu+7prONK

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	netprotocol.exe

Loads dropped DLL 2 IoCs

pid	Process
2836	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
2836	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1672	2836	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	28
PID 2836 wrote to memory of 1672	2836	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	28
PID 2836 wrote to memory of 1672	2836	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	28
PID 2836 wrote to memory of 1672	2836	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	28

C:\Users\Admin\AppData\Local\Temp\9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
"C:\Users\Admin\AppData\Local\Temp\9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Roaming\netprotocol.exe
  C:\Users\Admin\AppData\Roaming\netprotocol.exe
  2⤵
  - Executes dropped EXE
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
60KB

MD5
328e5ed1cb24ff66db20af73e272fd5b

SHA1
961153de29ec50d41b77b37a4f1cb0c19f14233a

SHA256
e551e5334787f05e93c61cdae75f806c410a5875ed5ad73804613b01cdf1b357

SHA512
835d95393871be371fbde3a46b40bbccde237a60e4ffb82decdbdcb13485287df71e01a0dd58dab6f903c498c1d668c8c5ced57f59530cbdee57f07d1b4c1347

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
60KB

MD5
328e5ed1cb24ff66db20af73e272fd5b

SHA1
961153de29ec50d41b77b37a4f1cb0c19f14233a

SHA256
e551e5334787f05e93c61cdae75f806c410a5875ed5ad73804613b01cdf1b357

SHA512
835d95393871be371fbde3a46b40bbccde237a60e4ffb82decdbdcb13485287df71e01a0dd58dab6f903c498c1d668c8c5ced57f59530cbdee57f07d1b4c1347

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
60KB

MD5
328e5ed1cb24ff66db20af73e272fd5b

SHA1
961153de29ec50d41b77b37a4f1cb0c19f14233a

SHA256
e551e5334787f05e93c61cdae75f806c410a5875ed5ad73804613b01cdf1b357

SHA512
835d95393871be371fbde3a46b40bbccde237a60e4ffb82decdbdcb13485287df71e01a0dd58dab6f903c498c1d668c8c5ced57f59530cbdee57f07d1b4c1347

Download Submit
\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
60KB

MD5
328e5ed1cb24ff66db20af73e272fd5b

SHA1
961153de29ec50d41b77b37a4f1cb0c19f14233a

SHA256
e551e5334787f05e93c61cdae75f806c410a5875ed5ad73804613b01cdf1b357

SHA512
835d95393871be371fbde3a46b40bbccde237a60e4ffb82decdbdcb13485287df71e01a0dd58dab6f903c498c1d668c8c5ced57f59530cbdee57f07d1b4c1347

Download Submit
memory/1672-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1672-12-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1672-14-0x0000000000340000-0x0000000000376000-memory.dmp

Filesize
216KB

Download
memory/1672-15-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1672-18-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2836-4-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2836-2-0x0000000000160000-0x0000000000196000-memory.dmp

Filesize
216KB

Download
memory/2836-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2836-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2836-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads