7dab47ea46cd68beb41f2bf13d64017efba62aa2270b224513c186972011e6a5

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6770fdc38a6f5f53c679e1186787350_exe32.exe
Size

204KB
MD5

e6770fdc38a6f5f53c679e1186787350
SHA1

eb7723f8271d7481146b2154beea5f522994bdda
SHA256

7dab47ea46cd68beb41f2bf13d64017efba62aa2270b224513c186972011e6a5
SHA512

a48739ff0027d837081f84ef341fab398043e3d189b7dfa5abf63cde83c80cb1018eb0153b859f6474fcaeabbc664d2113e13f4991e8453e31e605181c6de9e4
SSDEEP

3072:km3W82E0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWds:/me4QxL7B9W0c1RCzR/fSmlb

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e6770fdc38a6f5f53c679e1186787350_exe32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	duarac.exe

Executes dropped EXE 1 IoCs

pid	Process
3032	duarac.exe

Loads dropped DLL 2 IoCs

pid	Process
1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe
1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /u"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /n"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /f"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /d"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /l"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /c"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /k"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /k"	e6770fdc38a6f5f53c679e1186787350_exe32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /i"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /m"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /h"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /o"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /e"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /a"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /q"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /j"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /p"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /w"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /g"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /y"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /b"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /x"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /r"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /s"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /t"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /z"	duarac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Windows\CurrentVersion\Run\duarac = "C:\\Users\\Admin\\duarac.exe /v"	duarac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe
3032	duarac.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe
3032	duarac.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 3032	1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe	28
PID 1568 wrote to memory of 3032	1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe	28
PID 1568 wrote to memory of 3032	1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe	28
PID 1568 wrote to memory of 3032	1568	e6770fdc38a6f5f53c679e1186787350_exe32.exe	28

C:\Users\Admin\AppData\Local\Temp\e6770fdc38a6f5f53c679e1186787350_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\e6770fdc38a6f5f53c679e1186787350_exe32.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\duarac.exe
  "C:\Users\Admin\duarac.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\duarac.exe

Filesize
204KB

MD5
421d1ed7ff3557436c56b040673f26df

SHA1
80f0e6c474d1dcb547e4500835c3e1f539e7ddf5

SHA256
2bad4133ca1f19f21be3f7487d8daa39fd6e721e68d470bb02d4898479274fe5

SHA512
992f9a50580c1bc5ba56e3f829934591d184077629c5c0e841a23a28e752c94980ced8c232481996701efc0d531471435b6ff048e9c254bae7b4936b438faed9

Download Submit
C:\Users\Admin\duarac.exe

Filesize
204KB

MD5
421d1ed7ff3557436c56b040673f26df

SHA1
80f0e6c474d1dcb547e4500835c3e1f539e7ddf5

SHA256
2bad4133ca1f19f21be3f7487d8daa39fd6e721e68d470bb02d4898479274fe5

SHA512
992f9a50580c1bc5ba56e3f829934591d184077629c5c0e841a23a28e752c94980ced8c232481996701efc0d531471435b6ff048e9c254bae7b4936b438faed9

Download Submit
C:\Users\Admin\duarac.exe

Filesize
204KB

MD5
421d1ed7ff3557436c56b040673f26df

SHA1
80f0e6c474d1dcb547e4500835c3e1f539e7ddf5

SHA256
2bad4133ca1f19f21be3f7487d8daa39fd6e721e68d470bb02d4898479274fe5

SHA512
992f9a50580c1bc5ba56e3f829934591d184077629c5c0e841a23a28e752c94980ced8c232481996701efc0d531471435b6ff048e9c254bae7b4936b438faed9

Download Submit
\Users\Admin\duarac.exe

Filesize
204KB

MD5
421d1ed7ff3557436c56b040673f26df

SHA1
80f0e6c474d1dcb547e4500835c3e1f539e7ddf5

SHA256
2bad4133ca1f19f21be3f7487d8daa39fd6e721e68d470bb02d4898479274fe5

SHA512
992f9a50580c1bc5ba56e3f829934591d184077629c5c0e841a23a28e752c94980ced8c232481996701efc0d531471435b6ff048e9c254bae7b4936b438faed9

Download Submit
\Users\Admin\duarac.exe

Filesize
204KB

MD5
421d1ed7ff3557436c56b040673f26df

SHA1
80f0e6c474d1dcb547e4500835c3e1f539e7ddf5

SHA256
2bad4133ca1f19f21be3f7487d8daa39fd6e721e68d470bb02d4898479274fe5

SHA512
992f9a50580c1bc5ba56e3f829934591d184077629c5c0e841a23a28e752c94980ced8c232481996701efc0d531471435b6ff048e9c254bae7b4936b438faed9

Download Submit