4ecc427abbc3efbeae4fc42d383497728056a76951f5bad56a67002406eaca66

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1088af1951819e5a5f119c0430b06aa9.exe
Size 412KB
Sample231101-g3rtcsdf65
SHA256 4ecc427abbc3efbeae4fc42d383497728056a76951f5bad56a67002406eaca66
MD5 1088af1951819e5a5f119c0430b06aa9
SHA1 22b95a752b4111f0f488e6da2b09dcbd8aec5a4e
SHA512 eba671f613f9ff4346adda7505fc183a5ca6d2dbf39406fca67741ed1fabfb31a176bc7824b02de5a052d5261440a54df58b16230116d7ebbec8a395acb89c40
SSDEEP 6144:b8LxBqaNy0dwhrDkgHm/2/w4tuER0HEzD3RdjNlQIe2ed8V7DMfQyVsW2DxN0:XjhXkZOJtxRwU/2eBDMb+W2DQ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1548	xmnmdfjfg.exe
1316	xmnmdfjfg.exe

Loads dropped DLL 3 IoCs

pid	Process
2096	1088af1951819e5a5f119c0430b06aa9.exe
1548	xmnmdfjfg.exe
2868	control.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 1316	1548	xmnmdfjfg.exe	29
PID 1316 set thread context of 1232	1316	xmnmdfjfg.exe	21
PID 1316 set thread context of 2868	1316	xmnmdfjfg.exe	31
PID 2868 set thread context of 1232	2868	control.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2952504676-3105837840-1406404655-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	control.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1232	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1548	xmnmdfjfg.exe
1316	xmnmdfjfg.exe
1232	Explorer.EXE
1232	Explorer.EXE
2868	control.exe
2868	control.exe
2868	control.exe
2868	control.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1548	2096	1088af1951819e5a5f119c0430b06aa9.exe	28
PID 2096 wrote to memory of 1548	2096	1088af1951819e5a5f119c0430b06aa9.exe	28
PID 2096 wrote to memory of 1548	2096	1088af1951819e5a5f119c0430b06aa9.exe	28
PID 2096 wrote to memory of 1548	2096	1088af1951819e5a5f119c0430b06aa9.exe	28
PID 1548 wrote to memory of 1316	1548	xmnmdfjfg.exe	29
PID 1548 wrote to memory of 1316	1548	xmnmdfjfg.exe	29
PID 1548 wrote to memory of 1316	1548	xmnmdfjfg.exe	29
PID 1548 wrote to memory of 1316	1548	xmnmdfjfg.exe	29
PID 1548 wrote to memory of 1316	1548	xmnmdfjfg.exe	29
PID 1232 wrote to memory of 2868	1232	Explorer.EXE	31
PID 1232 wrote to memory of 2868	1232	Explorer.EXE	31
PID 1232 wrote to memory of 2868	1232	Explorer.EXE	31
PID 1232 wrote to memory of 2868	1232	Explorer.EXE	31
PID 2868 wrote to memory of 1640	2868	control.exe	35
PID 2868 wrote to memory of 1640	2868	control.exe	35
PID 2868 wrote to memory of 1640	2868	control.exe	35
PID 2868 wrote to memory of 1640	2868	control.exe	35
PID 2868 wrote to memory of 1640	2868	control.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\1088af1951819e5a5f119c0430b06aa9.exe
  "C:\Users\Admin\AppData\Local\Temp\1088af1951819e5a5f119c0430b06aa9.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
    "C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
      "C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1316
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4rnhilu.zip

Path C:\Users\Admin\AppData\Local\Temp\4rnhilu.zip
Size 542KB
SHA256 bdcd90d909c708eff9a829c01b428c2b24fafc15f63deccd064c2bb12b0a49e3
MD5 a9a3b70adcf65be80c9b00e65d158669
SHA1 f2149444f70b702a43ad1e058dea147d6ba2eb5d
SHA512 e06ea8f9d982ecd5bedf23676fa41b49d8673d9135f752655210c322529fb1441a4ef5f292825eea11ccb0cb516e873c33d16c3f800204511639c5b8db429290
SSDEEP 12288:HrVIJYS55B72YeuYJxZk62xr4Tl0n5xAfy0hnTJW:x+55B7NqxZk62x8xIavh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

kqkzwglq.enh

Path C:\Users\Admin\AppData\Local\Temp\kqkzwglq.enh
Size 264KB
SHA256 a126a47c32df6cc4affc4da4c3fa06a4d90da44a83bc0cf7c08f3f202a8c8ec0
MD5 5535db03c9cf5d873c575fbb582ba7e7
SHA1 5b4ad802a8580908b29d9476ebc374b5a1388c2f
SHA512 c43e1839997f9856a2dba610bb648d12fbf628ac7d46eacc0da6bb79f6b228508c12d601aa1e30ce729e0f1d318a371bd90f2271b68f1c63343e9dc30b3389d0
SSDEEP 6144:QN1Z/NLIxwhrDkgQm/2qw40uEReHhzD350Lhbq:QbZJhXkiOc0xR6liJq
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmnmdfjfg.exe

Path C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
Size 217KB
SHA256 e6effc15ac3611a9f2ce6e58e7376c0a1344a83e10f2acb8a89076fe16eaee0c
MD5 9392887b4a77be7f19419093b2a5770c
SHA1 211f844393d516302710fdb03895e1e755b68222
SHA512 c781511bf77cd7214b9e38f60c29c24fa6dbc11648dc508598b8980bbd8f3f27d5595e18aac6369e9c8d1525f5285145089be987972103b9b3e9a487af02fb9e
SSDEEP 6144:tU+P5S8RtFiKUl3dT2AUygcsQKnZfT1A:3PoQtFipanQKnVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmnmdfjfg.exe

Path C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
Size 217KB
SHA256 e6effc15ac3611a9f2ce6e58e7376c0a1344a83e10f2acb8a89076fe16eaee0c
MD5 9392887b4a77be7f19419093b2a5770c
SHA1 211f844393d516302710fdb03895e1e755b68222
SHA512 c781511bf77cd7214b9e38f60c29c24fa6dbc11648dc508598b8980bbd8f3f27d5595e18aac6369e9c8d1525f5285145089be987972103b9b3e9a487af02fb9e
SSDEEP 6144:tU+P5S8RtFiKUl3dT2AUygcsQKnZfT1A:3PoQtFipanQKnVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmnmdfjfg.exe

Path C:\Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
Size 217KB
SHA256 e6effc15ac3611a9f2ce6e58e7376c0a1344a83e10f2acb8a89076fe16eaee0c
MD5 9392887b4a77be7f19419093b2a5770c
SHA1 211f844393d516302710fdb03895e1e755b68222
SHA512 c781511bf77cd7214b9e38f60c29c24fa6dbc11648dc508598b8980bbd8f3f27d5595e18aac6369e9c8d1525f5285145089be987972103b9b3e9a487af02fb9e
SSDEEP 6144:tU+P5S8RtFiKUl3dT2AUygcsQKnZfT1A:3PoQtFipanQKnVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\sqlite3.dll
Size 1.0MB
SHA256 1f1a186ea26bd2462ea2a9cf35a816b92caf0897fdf332af3a61569e0ba97b24
MD5 ce5c15b5092877974d5b6476ad1cb2d7
SHA1 76a6fc307d1524081cba1886d312df97c9dd658f
SHA512 bb9ced38c63d2a29e18c38f60020cfdf0161384cd4ad6328352626643becdf49f6b4bef47012391720344fdd8ad520aa802dcbbed15b5026d27eb93b0a839c90
SSDEEP 24576:FRwXVREXm6CX7FgiX+y3sxroF/Ktlne05qj7:BmTXhznqroFYlno
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmnmdfjfg.exe

Path \Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
Size 217KB
SHA256 e6effc15ac3611a9f2ce6e58e7376c0a1344a83e10f2acb8a89076fe16eaee0c
MD5 9392887b4a77be7f19419093b2a5770c
SHA1 211f844393d516302710fdb03895e1e755b68222
SHA512 c781511bf77cd7214b9e38f60c29c24fa6dbc11648dc508598b8980bbd8f3f27d5595e18aac6369e9c8d1525f5285145089be987972103b9b3e9a487af02fb9e
SSDEEP 6144:tU+P5S8RtFiKUl3dT2AUygcsQKnZfT1A:3PoQtFipanQKnVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmnmdfjfg.exe

Path \Users\Admin\AppData\Local\Temp\xmnmdfjfg.exe
Size 217KB
SHA256 e6effc15ac3611a9f2ce6e58e7376c0a1344a83e10f2acb8a89076fe16eaee0c
MD5 9392887b4a77be7f19419093b2a5770c
SHA1 211f844393d516302710fdb03895e1e755b68222
SHA512 c781511bf77cd7214b9e38f60c29c24fa6dbc11648dc508598b8980bbd8f3f27d5595e18aac6369e9c8d1525f5285145089be987972103b9b3e9a487af02fb9e
SSDEEP 6144:tU+P5S8RtFiKUl3dT2AUygcsQKnZfT1A:3PoQtFipanQKnVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1232-29-0x0000000004810000-0x00000000048D4000-memory.dmp

Download

memory/1232-19-0x0000000000360000-0x0000000000460000-memory.dmp

Download

memory/1232-33-0x0000000004810000-0x00000000048D4000-memory.dmp

Download

memory/1232-30-0x0000000004810000-0x00000000048D4000-memory.dmp

Download

memory/1316-12-0x0000000000960000-0x0000000000C63000-memory.dmp

Download

memory/1316-17-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1316-18-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1316-20-0x0000000000290000-0x00000000002AD000-memory.dmp

Download

memory/1316-10-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1316-23-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1316-25-0x0000000000290000-0x00000000002AD000-memory.dmp

Download

memory/1316-13-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1548-6-0x00000000003F0000-0x00000000003F2000-memory.dmp

Download

memory/2868-27-0x00000000000C0000-0x00000000000FA000-memory.dmp

Download

memory/2868-28-0x00000000008B0000-0x000000000094C000-memory.dmp

Download

memory/2868-31-0x00000000000C0000-0x00000000000FA000-memory.dmp

Download

memory/2868-32-0x00000000008B0000-0x000000000094C000-memory.dmp

Download

memory/2868-26-0x0000000001FD0000-0x00000000022D3000-memory.dmp

Download

memory/2868-22-0x00000000000C0000-0x00000000000FA000-memory.dmp

Download

memory/2868-21-0x00000000000C0000-0x00000000000FA000-memory.dmp

Download

memory/2868-74-0x0000000061E00000-0x0000000061EED000-memory.dmp

Download