04a420cf0f6b299c574f027b6647fdde90ebf3b767ac74bf367a94f5d84c5863

Analysis

max time kernel
151s
max time network
146s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
Size

479KB
MD5

9851a2d1286ff5b49c70df955455f307
SHA1

72fcb74da7ef60348112ab39704440d9c2cd28c7
SHA256

04a420cf0f6b299c574f027b6647fdde90ebf3b767ac74bf367a94f5d84c5863
SHA512

6d2cc11833a1c64a2151343491990d115555dc5e4e3dd8ed5d62bce4c30097d20e1f78b524ccae7e99d6fac91aa8b3c9f4cf8a63f3906e9005efafd82ab484ad
SSDEEP

12288:aVlc87eqqV5e+wBV6O+b2ejjE0n5cS1fGyZrQ6K:aVSqqHeVBxgD0Q1fGyZk6K

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2412	ktmuocom.exe
2120	~A40C.tmp
2764	Dispelog.exe

Loads dropped DLL 3 IoCs

pid	Process
1600	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
1600	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
2412	ktmuocom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\mcbuetup = "C:\\Users\\Admin\\AppData\\Roaming\\Searcont\\ktmuocom.exe"	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dispelog.exe	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	ktmuocom.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	ktmuocom.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2412	1600	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe	28
PID 1600 wrote to memory of 2412	1600	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe	28
PID 1600 wrote to memory of 2412	1600	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe	28
PID 1600 wrote to memory of 2412	1600	NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe	28
PID 2412 wrote to memory of 2120	2412	ktmuocom.exe	29
PID 2412 wrote to memory of 2120	2412	ktmuocom.exe	29
PID 2412 wrote to memory of 2120	2412	ktmuocom.exe	29
PID 2412 wrote to memory of 2120	2412	ktmuocom.exe	29
PID 2120 wrote to memory of 1212	2120	~A40C.tmp	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1212
- C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe
    "C:\Users\Admin\AppData\Roaming\Searcont"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\~A40C.tmp
      1212 490504 2412 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2120

C:\Windows\SysWOW64\Dispelog.exe
C:\Windows\SysWOW64\Dispelog.exe -s
1⤵
- Executes dropped EXE
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~A40C.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
C:\Windows\SysWOW64\Dispelog.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
C:\Windows\SysWOW64\Dispelog.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
\Users\Admin\AppData\Local\Temp\~A40C.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

Filesize
479KB

MD5
096cbc5438f5277e6398888cbcd966e3

SHA1
6f4c95f883d0e1efa48bf649bbb0a00135fbc271

SHA256
1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

SHA512
30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

Download Submit
memory/1212-21-0x0000000003B00000-0x0000000003B87000-memory.dmp

Filesize
540KB

Download
memory/1212-29-0x0000000002B40000-0x0000000002B4D000-memory.dmp

Filesize
52KB

Download
memory/1212-24-0x0000000003B00000-0x0000000003B87000-memory.dmp

Filesize
540KB

Download
memory/1212-26-0x0000000002B30000-0x0000000002B36000-memory.dmp

Filesize
24KB

Download
memory/1212-22-0x0000000003B00000-0x0000000003B87000-memory.dmp

Filesize
540KB

Download
memory/1600-5-0x0000000000490000-0x0000000000512000-memory.dmp

Filesize
520KB

Download
memory/1600-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1600-11-0x0000000000490000-0x0000000000512000-memory.dmp

Filesize
520KB

Download
memory/1600-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1600-1-0x00000000002D0000-0x0000000000350000-memory.dmp

Filesize
512KB

Download
memory/2412-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2412-15-0x0000000000500000-0x0000000000580000-memory.dmp

Filesize
512KB

Download
memory/2412-16-0x00000000001D0000-0x00000000001D5000-memory.dmp

Filesize
20KB

Download
memory/2764-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2764-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download