c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe
Size

199KB
MD5

920ce4b2220b80e0f6df36464e1a6406
SHA1

5b10f0ac5e111791b623886e556b696124803c48
SHA256

c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79
SHA512

e7a13ba82f03d1a869588d15567ec933f6611e68159856cdfcf8454e3df46560d4686a6b44831a6646734f5c631e00dce7817677563019c596f1ffd9fbf10091
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOP:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXS

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
484	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2580	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2760	2580	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe	29
PID 2580 wrote to memory of 2760	2580	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe	29
PID 2580 wrote to memory of 2760	2580	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe	29
PID 2580 wrote to memory of 2760	2580	c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe	29

C:\Users\Admin\AppData\Local\Temp\c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe
"C:\Users\Admin\AppData\Local\Temp\c32a881f15138f2e0930b5159b347b15da5131264f153f86cfa83c768823fa79.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C32A88~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2760

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\rwmhost.exe

Filesize
199KB

MD5
0edd1096168491d2ad73ca8da548caef

SHA1
bf7010a80f22fc70fb8e20f0db4c55243a23bc99

SHA256
2471cd92ee4a0b48217b73f6e42c42e426044a9f01181388a3f93d5493505125

SHA512
2fbc3d737c11d8e7a735654ecfb4719afac486f9b9e13311e03730d86595d55b7d55784c999edbcc8872a2d1ca9f3b518aa656f9b3d100f8f337cb8612d36f54

Download Submit
C:\Windows\debug\rwmhost.exe

Filesize
199KB

MD5
0edd1096168491d2ad73ca8da548caef

SHA1
bf7010a80f22fc70fb8e20f0db4c55243a23bc99

SHA256
2471cd92ee4a0b48217b73f6e42c42e426044a9f01181388a3f93d5493505125

SHA512
2fbc3d737c11d8e7a735654ecfb4719afac486f9b9e13311e03730d86595d55b7d55784c999edbcc8872a2d1ca9f3b518aa656f9b3d100f8f337cb8612d36f54

Download Submit