2c6bb959bb8e6c8efb114d5739ac85b9b33c07c95ec6a856bbe974babea15b77

Analysis

max time kernel
165s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe
Size

234KB
MD5

e977b9e786d76f6f9b819035c13cea22
SHA1

36fff15038ec2a2ce4470626faf5598e7d233fc1
SHA256

2c6bb959bb8e6c8efb114d5739ac85b9b33c07c95ec6a856bbe974babea15b77
SHA512

17b92601765ee120134cb5bd9d080b65985e3b871b92695722ee61e21faac762b805b8fc76a20236e52191007e26648794de13e8667ed02be3920fb6b9cb387d
SSDEEP

6144:SxQ7OENQybYhlIEI9mXX2ZnpmVOxjMgG+SHcvqsWQuN9A36t8p:SxINNQyAlIEISX2OVa0MuXA36

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2988	dxdidctr.exe
2728	~A66D.tmp
2748	ndadutou.exe

Loads dropped DLL 3 IoCs

pid	Process
2080	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe
2080	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe
2988	dxdidctr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\msfeexer = "C:\\Users\\Admin\\AppData\\Roaming\\sethfWrp\\dxdidctr.exe"	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ndadutou.exe	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	dxdidctr.exe
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	dxdidctr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2988	2080	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe	27
PID 2080 wrote to memory of 2988	2080	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe	27
PID 2080 wrote to memory of 2988	2080	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe	27
PID 2080 wrote to memory of 2988	2080	NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe	27
PID 2988 wrote to memory of 2728	2988	dxdidctr.exe	28
PID 2988 wrote to memory of 2728	2988	dxdidctr.exe	28
PID 2988 wrote to memory of 2728	2988	dxdidctr.exe	28
PID 2988 wrote to memory of 2728	2988	dxdidctr.exe	28
PID 2728 wrote to memory of 1260	2728	~A66D.tmp	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1260
- C:\Users\Admin\AppData\Local\Temp\NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.e977b9e786d76f6f9b819035c13cea22_JC.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Roaming\sethfWrp\dxdidctr.exe
    "C:\Users\Admin\AppData\Roaming\sethfWrp"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\~A66D.tmp
      1260 239624 2988 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2728

C:\Windows\SysWOW64\ndadutou.exe
C:\Windows\SysWOW64\ndadutou.exe -s
1⤵
- Executes dropped EXE
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~A66D.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
C:\Users\Admin\AppData\Roaming\sethfWrp\dxdidctr.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
C:\Users\Admin\AppData\Roaming\sethfWrp\dxdidctr.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
C:\Users\Admin\AppData\Roaming\sethfWrp\dxdidctr.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
C:\Windows\SysWOW64\ndadutou.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
C:\Windows\SysWOW64\ndadutou.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
\Users\Admin\AppData\Local\Temp\~A66D.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
\Users\Admin\AppData\Roaming\sethfWrp\dxdidctr.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
\Users\Admin\AppData\Roaming\sethfWrp\dxdidctr.exe

Filesize
234KB

MD5
c74901895cd79f8131d07ba8222dc47f

SHA1
19bbb0e88caa377806996b27ad55476e44ddda92

SHA256
54d74eedc8654529df3b71649ccb4f02fd97bf642b7099eb3c0c7a1c5f0ad0b6

SHA512
23c6fe0daa457ae044714a83abebf253da4ed9a69688221c0ff7212191bfdef5a0ca766a556c72faaed41321ceaf7d438752da6d43ece2b0b52012a8d112e351

Download Submit
memory/1260-29-0x0000000002B50000-0x0000000002B56000-memory.dmp

Filesize
24KB

Download
memory/1260-24-0x0000000002A20000-0x0000000002A6A000-memory.dmp

Filesize
296KB

Download
memory/1260-41-0x000007FF008E0000-0x000007FF008EA000-memory.dmp

Filesize
40KB

Download
memory/1260-40-0x000007FEF59B0000-0x000007FEF5AF3000-memory.dmp

Filesize
1.3MB

Download
memory/1260-31-0x0000000002B60000-0x0000000002B6D000-memory.dmp

Filesize
52KB

Download
memory/1260-23-0x0000000002A20000-0x0000000002A6A000-memory.dmp

Filesize
296KB

Download
memory/1260-22-0x0000000002A20000-0x0000000002A6A000-memory.dmp

Filesize
296KB

Download
memory/2080-5-0x00000000002B0000-0x00000000002F3000-memory.dmp

Filesize
268KB

Download
memory/2080-11-0x0000000000360000-0x000000000039F000-memory.dmp

Filesize
252KB

Download
memory/2080-1-0x00000000002B0000-0x00000000002F3000-memory.dmp

Filesize
268KB

Download
memory/2080-13-0x0000000000360000-0x000000000039F000-memory.dmp

Filesize
252KB

Download
memory/2080-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2080-38-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2748-37-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2748-36-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2748-39-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2988-28-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2988-17-0x0000000000440000-0x0000000000483000-memory.dmp

Filesize
268KB

Download
memory/2988-18-0x00000000003C0000-0x00000000003C5000-memory.dmp

Filesize
20KB

Download
memory/2988-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download