41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe
Size

3.4MB
MD5

bdf7672f76ff6397df7a0d2ffdd8575b
SHA1

3cdc2551982252f892970857d8b76ba8ade92592
SHA256

41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc
SHA512

ffd1d9b11d9f8aebdb245253dec5763d46c18765cd46c8700bff57401984cb3959d58692c48238b8a4f9f90cb6332fa13050a1ae2dbfee5faed79a70ddfe212f
SSDEEP

49152:lZmp9ZRcmMC2Mb9fjzBEnUFJrIHt/GvRHR+0Idus1RAS1PZl0gIPhcrdkrNTlBBO:7SZRcmMC2IJxEZtmLPmevhc98

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5068	sc.exe
1856	sc.exe
3360	sc.exe
4544	sc.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
4684	taskkill.exe
1132	taskkill.exe
4132	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	1132	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe
4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4684	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	82
PID 4804 wrote to memory of 4684	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	82
PID 4804 wrote to memory of 4684	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	82
PID 4804 wrote to memory of 1132	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	86
PID 4804 wrote to memory of 1132	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	86
PID 4804 wrote to memory of 1132	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	86
PID 4804 wrote to memory of 4132	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	88
PID 4804 wrote to memory of 4132	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	88
PID 4804 wrote to memory of 4132	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	88
PID 4804 wrote to memory of 5068	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	90
PID 4804 wrote to memory of 5068	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	90
PID 4804 wrote to memory of 5068	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	90
PID 4804 wrote to memory of 1856	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	92
PID 4804 wrote to memory of 1856	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	92
PID 4804 wrote to memory of 1856	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	92
PID 4804 wrote to memory of 3360	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	94
PID 4804 wrote to memory of 3360	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	94
PID 4804 wrote to memory of 3360	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	94
PID 4804 wrote to memory of 4544	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	96
PID 4804 wrote to memory of 4544	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	96
PID 4804 wrote to memory of 4544	4804	41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe	96

C:\Users\Admin\AppData\Local\Temp\41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe
"C:\Users\Admin\AppData\Local\Temp\41c1ad5e4d64b06eff311b4105d8af1fa54dba4b00dd6cd085afee290f8455dc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im NarakaBladepoint.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im NeacClient.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1132
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im StartGame.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SysWOW64\sc.exe
  sc stop MyDriver
  2⤵
  - Launches sc.exe
  PID:5068
- C:\Windows\SysWOW64\sc.exe
  sc delete MyDriver
  2⤵
  - Launches sc.exe
  PID:1856
- C:\Windows\SysWOW64\sc.exe
  sc stop MyDriver
  2⤵
  - Launches sc.exe
  PID:3360
- C:\Windows\SysWOW64\sc.exe
  sc delete MyDriver
  2⤵
  - Launches sc.exe
  PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Windows 7 deprecation

Loading Replay Monitor...