cde2e1845435e14d8580d0e15264eecb234c7bb7e289abc71dd5f07f17a53d0f

Analysis

max time kernel
40s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 878KB
Sample231015-hdazzsdc6y
SHA256 cde2e1845435e14d8580d0e15264eecb234c7bb7e289abc71dd5f07f17a53d0f
MD5 b639244519764d606ac92428a744bfa0
SHA1 e92a06ca778547ff248c2d73d6c6038851529dfc
SHA512 e023f74680fbda2e22f01b65dcac0aec8335dfb45b9726d013ced74a0e1f1c1e869a239a5163edd34d725ef86858980e1047a4a5e81f23c5a562a2b898cb02f3
SSDEEP 24576:VygZpR/5ZCqbcUKGIyjq+ilI5HjPn7GZ2wv:wGR/rUGIyjzWO7
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1544	zF9oD24.exe
3308	cM8af82.exe
844	VJ0bu40.exe
2988	1BY19ac0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	cM8af82.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	VJ0bu40.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zF9oD24.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 4584	2988	1BY19ac0.exe	92

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1544	1568	file.exe	87
PID 1568 wrote to memory of 1544	1568	file.exe	87
PID 1568 wrote to memory of 1544	1568	file.exe	87
PID 1544 wrote to memory of 3308	1544	zF9oD24.exe	89
PID 1544 wrote to memory of 3308	1544	zF9oD24.exe	89
PID 1544 wrote to memory of 3308	1544	zF9oD24.exe	89
PID 3308 wrote to memory of 844	3308	cM8af82.exe	90
PID 3308 wrote to memory of 844	3308	cM8af82.exe	90
PID 3308 wrote to memory of 844	3308	cM8af82.exe	90
PID 844 wrote to memory of 2988	844	VJ0bu40.exe	91
PID 844 wrote to memory of 2988	844	VJ0bu40.exe	91
PID 844 wrote to memory of 2988	844	VJ0bu40.exe	91
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92
PID 2988 wrote to memory of 4584	2988	1BY19ac0.exe	92

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zF9oD24.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zF9oD24.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cM8af82.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cM8af82.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VJ0bu40.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VJ0bu40.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BY19ac0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BY19ac0.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2988
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2988 -ip 2988
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zF9oD24.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zF9oD24.exe
Size 739KB
SHA256 612f95cc2ee9d066d291cbdafd72972d1adacd51c07aabe648601cfa6047fefd
MD5 0bcaa7aaf0bb8080546bfc24a78bec3a
SHA1 53516809fc58166a8aaf350e6497d30da4f332a3
SHA512 09b2be49ca17f9bd0b3a6a2cbed5687164b8a7664e457700e7f5e60f1c63db9c08a83eed889a657f8b8cdfdc261384682e68734c8bfee4a5e5df3ae90ce48953
SSDEEP 12288:HMrRy90aUF4oM2eBteiA6c3x4jRS/fOPckKG1yMcq+ilIeH1lsUzmkbfamSs49:+yo4oLfVCRckKG1yRq+ilIeH1lakbyF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

zF9oD24.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zF9oD24.exe
Size 739KB
SHA256 612f95cc2ee9d066d291cbdafd72972d1adacd51c07aabe648601cfa6047fefd
MD5 0bcaa7aaf0bb8080546bfc24a78bec3a
SHA1 53516809fc58166a8aaf350e6497d30da4f332a3
SHA512 09b2be49ca17f9bd0b3a6a2cbed5687164b8a7664e457700e7f5e60f1c63db9c08a83eed889a657f8b8cdfdc261384682e68734c8bfee4a5e5df3ae90ce48953
SSDEEP 12288:HMrRy90aUF4oM2eBteiA6c3x4jRS/fOPckKG1yMcq+ilIeH1lsUzmkbfamSs49:+yo4oLfVCRckKG1yRq+ilIeH1lakbyF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

cM8af82.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cM8af82.exe
Size 503KB
SHA256 dcbb197508e5dcdce4002ed5f9ed5573eb6382beef600187de5baaaefe4ba859
MD5 a922c300ae424aa07a1ebee00e1e3b6d
SHA1 6209d672343529522b81b1ef6bb4e96138ac7020
SHA512 3f3f01b3aa0d4706856edd52340f4319dc5cacb8f88368116ac803ccb5435de7c499df78b376b21d4b1cfb3074eda3400edaa60a2bafcee1d7e1ee2c2297b6ed
SSDEEP 12288:PMrFy90T3c3e4jRPfXjSclKG1dJcq+ilIqHgCH:Oyl3gclKG1dqq+ilIqHgCH
MD5 SHA1 SHA512 SSDEEP

Submit Download

cM8af82.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cM8af82.exe
Size 503KB
SHA256 dcbb197508e5dcdce4002ed5f9ed5573eb6382beef600187de5baaaefe4ba859
MD5 a922c300ae424aa07a1ebee00e1e3b6d
SHA1 6209d672343529522b81b1ef6bb4e96138ac7020
SHA512 3f3f01b3aa0d4706856edd52340f4319dc5cacb8f88368116ac803ccb5435de7c499df78b376b21d4b1cfb3074eda3400edaa60a2bafcee1d7e1ee2c2297b6ed
SSDEEP 12288:PMrFy90T3c3e4jRPfXjSclKG1dJcq+ilIqHgCH:Oyl3gclKG1dqq+ilIqHgCH
MD5 SHA1 SHA512 SSDEEP

Submit Download

VJ0bu40.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VJ0bu40.exe
Size 317KB
SHA256 b24e634482ecb33664f777634bd1c5e2e395dfa06b541e0b890e91f66d7524a8
MD5 2c5926712c8145c25e2675f133c87c41
SHA1 4b0f973aedef36934a12ed638dfc3e7f0b568112
SHA512 61cb9a3819f7be231b23c5af2fac92c97e7ce91e94665385d78ab14392be268f183f4fdc02eb371021ef10ecab0a49fa35db8c85d89781e677e2637ae2568163
SSDEEP 6144:KVy+bnr+kp0yN90QEODHJ4ANeS4cmSIARScXKWPjh/rIJc7W+0:PMr4y90szaAbNgcXKm1IJcq+0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VJ0bu40.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VJ0bu40.exe
Size 317KB
SHA256 b24e634482ecb33664f777634bd1c5e2e395dfa06b541e0b890e91f66d7524a8
MD5 2c5926712c8145c25e2675f133c87c41
SHA1 4b0f973aedef36934a12ed638dfc3e7f0b568112
SHA512 61cb9a3819f7be231b23c5af2fac92c97e7ce91e94665385d78ab14392be268f183f4fdc02eb371021ef10ecab0a49fa35db8c85d89781e677e2637ae2568163
SSDEEP 6144:KVy+bnr+kp0yN90QEODHJ4ANeS4cmSIARScXKWPjh/rIJc7W+0:PMr4y90szaAbNgcXKm1IJcq+0
MD5 SHA1 SHA512 SSDEEP

Submit Download

1BY19ac0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BY19ac0.exe
Size 129KB
SHA256 b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa
MD5 4ed940ea493451635145489ffbdec386
SHA1 4b5d0ba229b8ac04f753864c1170da0070673e35
SHA512 8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c
SSDEEP 3072:o+ckTAk0lBdvy5tZkvLhu0qZMUQr73bC9SYLyFwEVKKPwJ:QkEdvy54hKnhEVFPwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1BY19ac0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1BY19ac0.exe
Size 129KB
SHA256 b736077e8eccf72bc48e2a28576bb47d59bdaa335baa2dc333fb3701becfacaa
MD5 4ed940ea493451635145489ffbdec386
SHA1 4b5d0ba229b8ac04f753864c1170da0070673e35
SHA512 8feea024e7bb279f401e144d80c20bd6022249ebe381e1ed36b7e19a382e1e7edd3a2b1e4f74e54a5e6dbe6bfe6ff3b27fb44fd0c2407551b1a33fbea9be229c
SSDEEP 3072:o+ckTAk0lBdvy5tZkvLhu0qZMUQr73bC9SYLyFwEVKKPwJ:QkEdvy54hKnhEVFPwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4584-28-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads