141a0b6086569cdb42b2c6016fa20bdb507ee3f5b6e42dba9f53a07dfea4bd7d

Analysis

max time kernel
106s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 02:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mgtOHJHXlrKDIio.exe
Size

525KB
MD5

35b6b59c21fd86b4db84f8b88bd92053
SHA1

c5001899f1b2d0d1b5bc548c625cee5a825663b7
SHA256

2909eec674cd7e9bc38e581262b2054af96d5177cf2208334eb79d6622eb1f56
SHA512

0462b06610db862e3123aa9bf0276c66c72e95f2b9646f01fd7e35bd7a9cc29fcf6f78804a900f504d258442b7eedf4e3cfdbe118e111221c767e1196b711e90
SSDEEP

6144:DYSaNW4uMVVrz+01Rn36mo/BOkfUCzRdLZdDv0yvEoDwtKbh7UwFhpgdf:faNF9VVrKGqmo/oksORdN9vvMw6Kbid

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	api.ipify.org
51	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 4068	3928	mgtOHJHXlrKDIio.exe	95

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	4068	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3928	mgtOHJHXlrKDIio.exe
4068	RegSvcs.exe
4068	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	mgtOHJHXlrKDIio.exe
Token: SeDebugPrivilege	4068	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95
PID 3928 wrote to memory of 4068	3928	mgtOHJHXlrKDIio.exe	95

C:\Users\Admin\AppData\Local\Temp\mgtOHJHXlrKDIio.exe
"C:\Users\Admin\AppData\Local\Temp\mgtOHJHXlrKDIio.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1984
    3⤵
    - Program crash
    PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4068 -ip 4068
1⤵
PID:4452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3928-10-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/3928-11-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3928-2-0x0000000004E10000-0x0000000004EAC000-memory.dmp

Filesize
624KB

Download
memory/3928-3-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/3928-4-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Filesize
584KB

Download
memory/3928-5-0x0000000002870000-0x0000000002880000-memory.dmp

Filesize
64KB

Download
memory/3928-6-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/3928-7-0x0000000005060000-0x00000000050B6000-memory.dmp

Filesize
344KB

Download
memory/3928-8-0x000000007FD20000-0x000000007FD30000-memory.dmp

Filesize
64KB

Download
memory/3928-9-0x0000000008890000-0x000000000889C000-memory.dmp

Filesize
48KB

Download
memory/3928-1-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/3928-12-0x000000007FD20000-0x000000007FD30000-memory.dmp

Filesize
64KB

Download
memory/3928-0-0x00000000002D0000-0x000000000035A000-memory.dmp

Filesize
552KB

Download
memory/3928-13-0x0000000006200000-0x0000000006280000-memory.dmp

Filesize
512KB

Download
memory/3928-14-0x00000000060E0000-0x0000000006122000-memory.dmp

Filesize
264KB

Download
memory/3928-18-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/4068-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4068-17-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download
memory/4068-19-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/4068-20-0x00000000051A0000-0x0000000005206000-memory.dmp

Filesize
408KB

Download
memory/4068-21-0x0000000074BA0000-0x0000000075350000-memory.dmp

Filesize
7.7MB

Download