157751c56a1eb0efd6a9c7cd4466352c3d5fa49b0c2f7dd01f8983548934bcdc

Analysis

max time kernel
150s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe
Size

234KB
MD5

56b78ca784a90d6b721031c1c1fc29d0
SHA1

07b6017e9a6eb8bb4bcab746f5855f23084c9a4c
SHA256

157751c56a1eb0efd6a9c7cd4466352c3d5fa49b0c2f7dd01f8983548934bcdc
SHA512

15bd2b3159b3a2293b8d19276b8b406d08bad41feeabeaa300bed4fe95a8db828c1adbc53f3d058daf2ed97ea07380d50b49e19e0a767c2d0577bab6b282b8fe
SSDEEP

6144:xCOYlvFX9SBn76cEU2BE9Ej9f5HYm7H308YC65B:x3Yl5UBnLEUGjjHY635a

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2284	mtstup16.exe
2656	~708E.tmp
2672	MRINetup.exe

Loads dropped DLL 3 IoCs

pid	Process
372	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe
372	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe
2284	mtstup16.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\ocseeout = "C:\\Users\\Admin\\AppData\\Roaming\\ktmuPING\\mtstup16.exe"	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MRINetup.exe	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2284	mtstup16.exe
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	mtstup16.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 2284	372	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe	28
PID 372 wrote to memory of 2284	372	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe	28
PID 372 wrote to memory of 2284	372	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe	28
PID 372 wrote to memory of 2284	372	NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe	28
PID 2284 wrote to memory of 2656	2284	mtstup16.exe	29
PID 2284 wrote to memory of 2656	2284	mtstup16.exe	29
PID 2284 wrote to memory of 2656	2284	mtstup16.exe	29
PID 2284 wrote to memory of 2656	2284	mtstup16.exe	29
PID 2656 wrote to memory of 1272	2656	~708E.tmp	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1272
- C:\Users\Admin\AppData\Local\Temp\NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.56b78ca784a90d6b721031c1c1fc29d0.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Users\Admin\AppData\Roaming\ktmuPING\mtstup16.exe
    "C:\Users\Admin\AppData\Roaming\ktmuPING"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\~708E.tmp
      1272 239624 2284 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2656

C:\Windows\SysWOW64\MRINetup.exe
C:\Windows\SysWOW64\MRINetup.exe -s
1⤵
- Executes dropped EXE
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~708E.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
C:\Users\Admin\AppData\Roaming\ktmuPING\mtstup16.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
C:\Users\Admin\AppData\Roaming\ktmuPING\mtstup16.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
C:\Users\Admin\AppData\Roaming\ktmuPING\mtstup16.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
C:\Windows\SysWOW64\MRINetup.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
C:\Windows\SysWOW64\MRINetup.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
\Users\Admin\AppData\Local\Temp\~708E.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
\Users\Admin\AppData\Roaming\ktmuPING\mtstup16.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
\Users\Admin\AppData\Roaming\ktmuPING\mtstup16.exe

Filesize
234KB

MD5
0f9e9d5d695049562ca0f97d0c7afebd

SHA1
521f791f23c12b8c0ea5f45395017256a73d97f2

SHA256
c1f873b2a2bf3d52a6076731e2205e4d9aaae53061514a6ec00fcbeef181fc93

SHA512
5b3babce9115e5838802542ed7ee73a1a059a6b9d8dc467b54f8fab3824ea04e7a9f481d211b37dc802aaa7965a96fc1ece47711094f9700017de03c91091a07

Download Submit
memory/372-32-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/372-5-0x0000000000370000-0x00000000003AF000-memory.dmp

Filesize
252KB

Download
memory/372-37-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/372-1-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/372-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/372-12-0x0000000000370000-0x00000000003AF000-memory.dmp

Filesize
252KB

Download
memory/1272-21-0x0000000002970000-0x00000000029BA000-memory.dmp

Filesize
296KB

Download
memory/1272-26-0x0000000002A60000-0x0000000002A66000-memory.dmp

Filesize
24KB

Download
memory/1272-23-0x0000000002970000-0x00000000029BA000-memory.dmp

Filesize
296KB

Download
memory/1272-29-0x0000000002A70000-0x0000000002A7D000-memory.dmp

Filesize
52KB

Download
memory/1272-22-0x0000000002970000-0x00000000029BA000-memory.dmp

Filesize
296KB

Download
memory/2284-15-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2284-17-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2284-16-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/2672-36-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2672-35-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2672-38-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download