Overview
overview
10Static
static
10001e9becdd...93.exe
windows10-2004-x64
71a1cf2a2f6...31.exe
windows10-2004-x64
72eac3720bc...61.exe
windows10-2004-x64
1320e3af17b...4c.exe
windows10-2004-x64
333bcab7033...70.exe
windows10-2004-x64
647a52afd63...2e.exe
windows10-2004-x64
104b24d27301...69.exe
windows10-2004-x64
74c481d251f...5a.exe
windows10-2004-x64
14c9ab76300...dd.exe
windows10-2004-x64
650a04b093c...95.dll
windows10-2004-x64
65266183553...2f.dll
windows10-2004-x64
8547798defb...6e.exe
windows10-2004-x64
105fb2242c04...96.exe
windows10-2004-x64
163a0bf6385...12.exe
windows10-2004-x64
106a08b51e02...68.exe
windows10-2004-x64
5803d827a2c...53.exe
windows10-2004-x64
785523c6377...c3.exe
windows10-2004-x64
38ab3db7349...03.exe
windows10-2004-x64
99b87457fe8...f0.exe
windows10-2004-x64
8a3c7b0df18...cc.exe
windows10-2004-x64
1ab4fa067af...38.exe
windows10-2004-x64
10b1c5c3ca41...7d.exe
windows10-2004-x64
3ca561f9403...c5.exe
windows10-2004-x64
7d278eb3d6c...8f.exe
windows10-2004-x64
6d3e04348f4...91.exe
windows10-2004-x64
10d7e876a714...c9.exe
windows10-2004-x64
7dd8bf2763c...38.exe
windows10-2004-x64
dd9ca1355f...9a.exe
windows10-2004-x64
7dd9d07d1f5...27.exe
windows10-2004-x64
10ef3c260fed...49.exe
windows10-2004-x64
10f40df86d68...df.exe
windows10-2004-x64
10fb861230c0...01.exe
windows10-2004-x64
3Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2023 21:16
Behavioral task
behavioral1
Sample
001e9becdd7d9887c6fbe487073ad3dc068124a5300f4128d9ed32db4f63f793.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
1a1cf2a2f6a49b8d2a84b9b5ec5f783e7d9be30b6a17a28795bc351bb3cdde31.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
2eac3720bcfb4550e3093f053880b373068360bc8583f2aee059905bcad29c61.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
320e3af17bb8787283fe0c4af9d3a778c191d8374f19c0bc6b6ee2f22363094c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
33bcab70334406fb3331b4b3fffbf8c51df52d93efb5d673d865b7a7496b1570.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
4b24d273019579ba3c1e0ad261954c0941d114aab802fa2d1fcb14dab9f3e869.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
4c481d251f29295af1af599374ea93f9fc24b6139fbb02ec115bec9f4e7bc25a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
4c9ab763001721e04e9efc44e1e97351557f8a4b1cf5471b141e7358cd1296dd.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral10
Sample
50a04b093c8f05481eb672ebec0537f61e233071798d1f3b939e17e333b51795.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
5266183553addd392a0968ea9e835c00e55a27468829ab65832cda37508c8e2f.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
547798defb6d577ec9f13b00fb1be293f903aaa974ddc049be16d6437aeec86e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
5fb2242c04ce18830b84de73c4f0fc4e9c8a5e6877a14f414fcbfaa5a3948896.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral14
Sample
63a0bf6385356dd0297449bdca2a2f171846315505800e81a4c0285f09c87312.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
6a08b51e02a7b510972907c326041222ff4632ba53b89573fca7e80b59c4e168.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral16
Sample
803d827a2cd764008783e691ce132ef853dbfa77017e5d2eeae47ceb3ca50f53.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
85523c6377c27e22068a2ef347997a295981b91e103b3cf3387ed80aa0b010c3.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral18
Sample
8ab3db7349f38d6463a3c6a7155ab297f18d92262a098064ea2472cecc7e3103.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
9b87457fe85670e2c059cedaa560a8a31027e96fe18b2b6a7fe610f38423b2f0.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral20
Sample
a3c7b0df189bdd47c7e113ff3b664f26b0bcd6f4f878186e882ea199e15c28cc.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral22
Sample
b1c5c3ca41c322b47a5feb62ebb0e5daa3c1c682aa1dedb98fd3b7dff3eca57d.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
ca561f9403ab4be76ca66646df1a3da826fa2cc1972dd005ad23861abb317cc5.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral24
Sample
d278eb3d6cc29c6de4b086aaa6214412d62fe2bb850c0ead63a403c3a24b2c8f.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
d7e876a714e2632fa42e6636177962516736074c76f486dc34de020ec13af0c9.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral27
Sample
dd8bf2763ce09cbeb21cdbf802b9f7475c7998e459714150fae07ffcd027bb38.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral28
Sample
dd9ca1355ff3ddd883f9d2d0e6df9b7a8ebff650003a616c533b30554cee2a9a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral29
Sample
dd9d07d1f5bb4facb1b4e412ce9e52a5ca9a689f2f78c34bacf63af19f7ce127.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral30
Sample
ef3c260fed0a71f0e679261aeb242133899f9ff03d68b5f95711a66ef919e549.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral31
Sample
f40df86d68d075c73e1be8ed5b3201f0e55a9eccf662258a219acee35df398df.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral32
Sample
fb861230c088dd68f1a6c782e9ad0b44a1831ccc29c0516635cc4b3de2a91a01.exe
Resource
win10v2004-20231023-en
General
-
Target
47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exe
-
Size
692KB
-
MD5
d631afaace32d5329733a9a9a49e51c1
-
SHA1
898bbd2972f932b201aa0d0470b971777965839e
-
SHA256
47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e
-
SHA512
c01266f21d9b3b0ad171389cd5e0fc7b65f51dad98436dc73bd37f6d997ec87197fd0303af4b26e296ac4b9bdc975127dcaed2898c02def7bb4f3845ea155c94
-
SSDEEP
12288:1ijnGp4df9EfRSnFwj6pNYSb8mXcfeD+EJY7bZHJNzejM2vkdISFDfken5:wnGabS2FwewZHvd/dLdTBnn5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exe" 47a52afd63406238b1b5ce59a7cb282685629b14169405015b0cef20fbe4f62e.exe -
Processes:
resource yara_rule behavioral6/memory/4692-0-0x0000000000400000-0x0000000000DF8000-memory.dmp upx