1c66069274f405ea6b6b81edbfc895746645d11478baba802f53e48db51931bb

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe
Size

484KB
MD5

0fbebd1b0cdb2cb4080b9090d0c16b0e
SHA1

edef493999d1f37b1bc44f2c8d4eda738a960e3f
SHA256

1c66069274f405ea6b6b81edbfc895746645d11478baba802f53e48db51931bb
SHA512

6cd07e1d17319a837f17cf50c1e44c564af655131926b6126debee96af0e99c8652dbde9751c0dfdfe58f6d40ef6eaccbea5149563cb32bd8b2a714d876f091c
SSDEEP

12288:vXlc87eqqV5e+wBV6O+tla9ztYlJw8eY6Yoo:vXSqqHeVBxSgOPpoo

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2932	dcomutil.exe
2652	~74D2.tmp
2584	ctfmhost.exe

Loads dropped DLL 3 IoCs

pid	Process
1540	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe
1540	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe
2932	dcomutil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\dxdiexec = "C:\\Users\\Admin\\AppData\\Roaming\\bthuelog\\dcomutil.exe"	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ctfmhost.exe	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	dcomutil.exe
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1188	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	dcomutil.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2932	1540	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe	28
PID 1540 wrote to memory of 2932	1540	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe	28
PID 1540 wrote to memory of 2932	1540	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe	28
PID 1540 wrote to memory of 2932	1540	NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe	28
PID 2932 wrote to memory of 2652	2932	dcomutil.exe	29
PID 2932 wrote to memory of 2652	2932	dcomutil.exe	29
PID 2932 wrote to memory of 2652	2932	dcomutil.exe	29
PID 2932 wrote to memory of 2652	2932	dcomutil.exe	29
PID 2652 wrote to memory of 1188	2652	~74D2.tmp	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1188
- C:\Users\Admin\AppData\Local\Temp\NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.0fbebd1b0cdb2cb4080b9090d0c16b0e_JC.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Roaming\bthuelog\dcomutil.exe
    "C:\Users\Admin\AppData\Roaming\bthuelog"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\~74D2.tmp
      1188 496136 2932 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2652

C:\Windows\SysWOW64\ctfmhost.exe
C:\Windows\SysWOW64\ctfmhost.exe -s
1⤵
- Executes dropped EXE
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~74D2.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
C:\Users\Admin\AppData\Roaming\bthuelog\dcomutil.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
C:\Users\Admin\AppData\Roaming\bthuelog\dcomutil.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
C:\Users\Admin\AppData\Roaming\bthuelog\dcomutil.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
C:\Windows\SysWOW64\ctfmhost.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
C:\Windows\SysWOW64\ctfmhost.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
\Users\Admin\AppData\Local\Temp\~74D2.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
\Users\Admin\AppData\Roaming\bthuelog\dcomutil.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
\Users\Admin\AppData\Roaming\bthuelog\dcomutil.exe

Filesize
484KB

MD5
da8a899f54e4de65f50bc0fe71ad38f7

SHA1
376062a2e204c5fb2f76a99f854cedb8a1be92ca

SHA256
e65b34fa79b00878d618e8db63e376ce5f2dec68c08751e498d33bb6f51af5c4

SHA512
f3cace666851a43a9a2aa027f96c7aaae87a0eb5c025228861fe9f4594f8236c8f0b3eb36736aaabf9881a02abed67d7cc8e3da4ec2369263c8150435b9e082f

Download Submit
memory/1188-22-0x0000000004840000-0x00000000048C9000-memory.dmp

Filesize
548KB

Download
memory/1188-31-0x0000000002B00000-0x0000000002B0D000-memory.dmp

Filesize
52KB

Download
memory/1188-27-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/1188-21-0x0000000004840000-0x00000000048C9000-memory.dmp

Filesize
548KB

Download
memory/1188-24-0x0000000004840000-0x00000000048C9000-memory.dmp

Filesize
548KB

Download
memory/1540-33-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1540-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1540-13-0x0000000000490000-0x0000000000513000-memory.dmp

Filesize
524KB

Download
memory/1540-10-0x0000000000490000-0x0000000000513000-memory.dmp

Filesize
524KB

Download
memory/1540-1-0x0000000000320000-0x00000000003A2000-memory.dmp

Filesize
520KB

Download
memory/2584-32-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/2584-30-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2584-37-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

Filesize
24KB

Download
memory/2932-17-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2932-14-0x0000000000220000-0x00000000002A2000-memory.dmp

Filesize
520KB

Download
memory/2932-20-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download