b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe
Size

199KB
MD5

8be096396730e81a6470d8109434484f
SHA1

7dc4accca98049649f0f4dcea4633c66fdf1cae7
SHA256

b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771
SHA512

5222871e62d1600938ddc6e3e59f7d70819ce7ee3047a506e963934e4b38a2331ee78a8bad9d35f347596ed1225a6a5f2a888ce04adb33b0843ae39824b44bda
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO4:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXR

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2560	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1504	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2228	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2560	2228	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe	29
PID 2228 wrote to memory of 2560	2228	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe	29
PID 2228 wrote to memory of 2560	2228	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe	29
PID 2228 wrote to memory of 2560	2228	b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe	29

C:\Users\Admin\AppData\Local\Temp\b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe
"C:\Users\Admin\AppData\Local\Temp\b851e7dbe0692e80955f40b7bf2bf76725df711f73a5385d7f54aab57611c771.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B851E7~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2560

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\rwmhost.exe

Filesize
199KB

MD5
c00b6f87b47d83cccee1fd671153b881

SHA1
7399909176ca7d41f784c0c4d0bc7edee3965813

SHA256
d487eccad8e0f43153ba8cc9616bde1841d0cc4b050939474d0b67857c06cf9c

SHA512
e1d845c7b9e78e9bd74a76f78d8ed51c6c1b10820bfc26d8572735edeac0b1e5e4386adc85455507af978c602534b2cb134757ec067262f70338110b63a2f251

Download Submit