e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420_JC.exe
Size 364KB
Sample231011-2agg5shh96
SHA256 e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420
MD5 c47642c922a6b1e1c7895d551af5903e
SHA1 08fa9bc939fb754d1656d84e38607a10b1928fbb
SHA512 e32628d8ac9a5c0695ea03b5795dd7e649622cc2ee0777254f0b4f6fb07b244a0568619a1f6c3fcb8ed0f08c227b1785b40c8e592e379322ec5c4136026d9f87
SSDEEP 6144:/Ya614f9MWi3S2Go5IYUx2b0gwHyXyTEGD/1ABCkpHujZhCVgw8o3nMQrLESacrD:/Y/5Wi3VF5IBob5iyXUEq/KBDHuXegwn
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4416	rdzugqwyci.exe
3624	rdzugqwyci.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4416 set thread context of 3624	4416	rdzugqwyci.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
548	3624	WerFault.exe	92

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4416	rdzugqwyci.exe
4416	rdzugqwyci.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4416	3920	e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420_JC.exe	91
PID 3920 wrote to memory of 4416	3920	e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420_JC.exe	91
PID 3920 wrote to memory of 4416	3920	e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420_JC.exe	91
PID 4416 wrote to memory of 3624	4416	rdzugqwyci.exe	92
PID 4416 wrote to memory of 3624	4416	rdzugqwyci.exe	92
PID 4416 wrote to memory of 3624	4416	rdzugqwyci.exe	92
PID 4416 wrote to memory of 3624	4416	rdzugqwyci.exe	92

C:\Users\Admin\AppData\Local\Temp\e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e3ce9444dfc95f0d5277b159262a1803c89e4ade3fba74d476f546e96d12d420_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe
  "C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe
    "C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe"
    3⤵
    - Executes dropped EXE
    PID:3624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 184
      4⤵
      Program crash
      PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3624 -ip 3624
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rdzugqwyci.exe

Path C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe
Size 194KB
SHA256 fc81cb1f74c4906c324a9277e821f300647bb9aae4288adc426086311fd14542
MD5 b3d7fa84fe5158c47c0b0e0cee39caa5
SHA1 384bbd65491df70c3a9cc3e6c98e6cc111303a17
SHA512 9fce33f9b3f317ecfbb376a65152d98eac4c51dd71946f639c640981cecb44d96b31186d8f0787d59af1d58db2fd73c9f1ba30927d3c4c6af1cf416773c60ad6
SSDEEP 3072:6/YnT9VWxHD8ANSBrRpWL8y9JsXnp3jQT9hitaBompUdVAg0Fuj396LVWbM:6/YTbkDoBlpWgU8nVM9kt5AOp6iM
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdzugqwyci.exe

Path C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe
Size 194KB
SHA256 fc81cb1f74c4906c324a9277e821f300647bb9aae4288adc426086311fd14542
MD5 b3d7fa84fe5158c47c0b0e0cee39caa5
SHA1 384bbd65491df70c3a9cc3e6c98e6cc111303a17
SHA512 9fce33f9b3f317ecfbb376a65152d98eac4c51dd71946f639c640981cecb44d96b31186d8f0787d59af1d58db2fd73c9f1ba30927d3c4c6af1cf416773c60ad6
SSDEEP 3072:6/YnT9VWxHD8ANSBrRpWL8y9JsXnp3jQT9hitaBompUdVAg0Fuj396LVWbM:6/YTbkDoBlpWgU8nVM9kt5AOp6iM
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdzugqwyci.exe

Path C:\Users\Admin\AppData\Local\Temp\rdzugqwyci.exe
Size 194KB
SHA256 fc81cb1f74c4906c324a9277e821f300647bb9aae4288adc426086311fd14542
MD5 b3d7fa84fe5158c47c0b0e0cee39caa5
SHA1 384bbd65491df70c3a9cc3e6c98e6cc111303a17
SHA512 9fce33f9b3f317ecfbb376a65152d98eac4c51dd71946f639c640981cecb44d96b31186d8f0787d59af1d58db2fd73c9f1ba30927d3c4c6af1cf416773c60ad6
SSDEEP 3072:6/YnT9VWxHD8ANSBrRpWL8y9JsXnp3jQT9hitaBompUdVAg0Fuj396LVWbM:6/YTbkDoBlpWgU8nVM9kt5AOp6iM
MD5 SHA1 SHA512 SSDEEP

Submit Download

zogfcwxt.yr

Path C:\Users\Admin\AppData\Local\Temp\zogfcwxt.yr
Size 231KB
SHA256 ecb36860bcb756ffeceb6f4e0bf8c733ad1fb0d4f7a6e7a6b87c864a38b7b0b4
MD5 80666614f63c4025736d3d8b93d0f895
SHA1 45196a3ad9b59f6186906ee256338ae37e134c50
SHA512 4228e2ddf413c40428072088551698b4741d251d8133ee66765a94d84d28e50bbc9a963835bc8a10df1e013468afa9d883b60eb6aa920e77b6261cb5fde88aef
SSDEEP 6144:UhJou5RR1UFledtzaGTBAGO45lA7+Nqu03:QJoCR3YezfVjL5lAyHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3624-7-0x0000000000590000-0x00000000005C5000-memory.dmp

Download

memory/4416-5-0x0000000000EB0000-0x0000000000EB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads