141a0b6086569cdb42b2c6016fa20bdb507ee3f5b6e42dba9f53a07dfea4bd7d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
05/10/2023, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mgtOHJHXlrKDIio.exe
Size

525KB
MD5

35b6b59c21fd86b4db84f8b88bd92053
SHA1

c5001899f1b2d0d1b5bc548c625cee5a825663b7
SHA256

2909eec674cd7e9bc38e581262b2054af96d5177cf2208334eb79d6622eb1f56
SHA512

0462b06610db862e3123aa9bf0276c66c72e95f2b9646f01fd7e35bd7a9cc29fcf6f78804a900f504d258442b7eedf4e3cfdbe118e111221c767e1196b711e90
SSDEEP

6144:DYSaNW4uMVVrz+01Rn36mo/BOkfUCzRdLZdDv0yvEoDwtKbh7UwFhpgdf:faNF9VVrKGqmo/oksORdN9vvMw6Kbid

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 940 set thread context of 2688	940	mgtOHJHXlrKDIio.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2688	RegSvcs.exe
2688	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	mgtOHJHXlrKDIio.exe
Token: SeDebugPrivilege	2688	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30
PID 940 wrote to memory of 2688	940	mgtOHJHXlrKDIio.exe	30

C:\Users\Admin\AppData\Local\Temp\mgtOHJHXlrKDIio.exe
"C:\Users\Admin\AppData\Local\Temp\mgtOHJHXlrKDIio.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-26-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/940-1-0x0000000000E30000-0x0000000000EBA000-memory.dmp

Filesize
552KB

Download
memory/940-2-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download
memory/940-3-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/940-4-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/940-5-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/940-6-0x0000000000590000-0x00000000005D0000-memory.dmp

Filesize
256KB

Download
memory/940-7-0x000000007EF40000-0x000000007EF50000-memory.dmp

Filesize
64KB

Download
memory/940-8-0x0000000005600000-0x0000000005680000-memory.dmp

Filesize
512KB

Download
memory/940-9-0x0000000000910000-0x0000000000952000-memory.dmp

Filesize
264KB

Download
memory/940-0-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-25-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-27-0x0000000000700000-0x0000000000740000-memory.dmp

Filesize
256KB

Download
memory/2688-28-0x0000000074200000-0x00000000748EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-29-0x0000000000700000-0x0000000000740000-memory.dmp

Filesize
256KB

Download