1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

28/10/2023, 19:29

24/10/2023, 13:29

18/10/2023, 12:04

07/09/2023, 12:10

Analysis

max time kernel
597s
max time network
548s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
Size

60KB
MD5

45b1f6b08b638607c986ae69b49fb6aa
SHA1

e3bdde86d74c49fe509973433682e45a297cbfc1
SHA256

9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909
SHA512

da41008b77cdf32f1585ad1d0ebf9855d2fea30e50fb167c493202665b6e43f0eb7b5c2e8264e8fbf5d3c73ab1142c5cf0721a24a24ddcfc04b9d04aa66760c7
SSDEEP

768:51lmUVT0rOklf9uBcCmD6gwZ8E1g508AFN63Lul5b92SOjbxR1sWh7vZPrONK5:n2akOcvs8SiLul5Zmu+7prONK

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5048	netprotocol.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 5048	976	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	89
PID 976 wrote to memory of 5048	976	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	89
PID 976 wrote to memory of 5048	976	9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe	89

C:\Users\Admin\AppData\Local\Temp\9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe
"C:\Users\Admin\AppData\Local\Temp\9ff988d7ea76e8379b5da6af3455b859957e7dfe572181041c35b10390780909.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Roaming\netprotocol.exe
  C:\Users\Admin\AppData\Roaming\netprotocol.exe
  2⤵
  - Executes dropped EXE
  PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
60KB

MD5
328e5ed1cb24ff66db20af73e272fd5b

SHA1
961153de29ec50d41b77b37a4f1cb0c19f14233a

SHA256
e551e5334787f05e93c61cdae75f806c410a5875ed5ad73804613b01cdf1b357

SHA512
835d95393871be371fbde3a46b40bbccde237a60e4ffb82decdbdcb13485287df71e01a0dd58dab6f903c498c1d668c8c5ced57f59530cbdee57f07d1b4c1347

Download Submit
C:\Users\Admin\AppData\Roaming\netprotocol.exe

Filesize
60KB

MD5
328e5ed1cb24ff66db20af73e272fd5b

SHA1
961153de29ec50d41b77b37a4f1cb0c19f14233a

SHA256
e551e5334787f05e93c61cdae75f806c410a5875ed5ad73804613b01cdf1b357

SHA512
835d95393871be371fbde3a46b40bbccde237a60e4ffb82decdbdcb13485287df71e01a0dd58dab6f903c498c1d668c8c5ced57f59530cbdee57f07d1b4c1347

Download Submit
memory/976-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/976-1-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/976-2-0x0000000001DF0000-0x0000000001E26000-memory.dmp

Filesize
216KB

Download
memory/976-4-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/976-11-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/976-13-0x0000000001DF0000-0x0000000001E26000-memory.dmp

Filesize
216KB

Download
memory/5048-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5048-10-0x0000000001DB0000-0x0000000001DE6000-memory.dmp

Filesize
216KB

Download
memory/5048-9-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5048-14-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads