292f72cec7b5c20c7993fdc7b19f453479a5f1ab32209efdbd1ffa3578d0fa77

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06-11-2023 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.7915369f8c768ededa7e9660a641e2b0.exe
Size

234KB
MD5

7915369f8c768ededa7e9660a641e2b0
SHA1

4317b4db04bf6ad5a87ae62b79e991a5df019c09
SHA256

292f72cec7b5c20c7993fdc7b19f453479a5f1ab32209efdbd1ffa3578d0fa77
SHA512

3d027b53cd0c4372226b120c8fa6b580b541990de80fd6bd9fe645aaad87501acd3b186b488cab1520446e5f43400fa796b768bd235ce8a461cf5cb788046771
SSDEEP

6144:8zYFBHhnEQaTOsoEeA1hTPgGEA1m847hGk1UXhVV:8zaBH4qq1hTofA1jCg0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1728	charnatt.exe
2712	~70EC.tmp
2776	convitch.exe

Loads dropped DLL 3 IoCs

pid	Process
2516	NEAS.7915369f8c768ededa7e9660a641e2b0.exe
2516	NEAS.7915369f8c768ededa7e9660a641e2b0.exe
1728	charnatt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\convures = "C:\\Users\\Admin\\AppData\\Roaming\\ndadutou\\charnatt.exe"	NEAS.7915369f8c768ededa7e9660a641e2b0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\convitch.exe	NEAS.7915369f8c768ededa7e9660a641e2b0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1728	charnatt.exe
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE
1240	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1240	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	charnatt.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1728	2516	NEAS.7915369f8c768ededa7e9660a641e2b0.exe	28
PID 2516 wrote to memory of 1728	2516	NEAS.7915369f8c768ededa7e9660a641e2b0.exe	28
PID 2516 wrote to memory of 1728	2516	NEAS.7915369f8c768ededa7e9660a641e2b0.exe	28
PID 2516 wrote to memory of 1728	2516	NEAS.7915369f8c768ededa7e9660a641e2b0.exe	28
PID 1728 wrote to memory of 2712	1728	charnatt.exe	29
PID 1728 wrote to memory of 2712	1728	charnatt.exe	29
PID 1728 wrote to memory of 2712	1728	charnatt.exe	29
PID 1728 wrote to memory of 2712	1728	charnatt.exe	29
PID 2712 wrote to memory of 1240	2712	~70EC.tmp	20

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1240
- C:\Users\Admin\AppData\Local\Temp\NEAS.7915369f8c768ededa7e9660a641e2b0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.7915369f8c768ededa7e9660a641e2b0.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Roaming\ndadutou\charnatt.exe
    "C:\Users\Admin\AppData\Roaming\ndadutou"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\~70EC.tmp
      1240 239624 1728 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2712

C:\Windows\SysWOW64\convitch.exe
C:\Windows\SysWOW64\convitch.exe -s
1⤵
- Executes dropped EXE
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~70EC.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
C:\Users\Admin\AppData\Roaming\ndadutou\charnatt.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
C:\Users\Admin\AppData\Roaming\ndadutou\charnatt.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
C:\Users\Admin\AppData\Roaming\ndadutou\charnatt.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
C:\Windows\SysWOW64\convitch.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
C:\Windows\SysWOW64\convitch.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
\Users\Admin\AppData\Local\Temp\~70EC.tmp

Filesize
8KB

MD5
86dc243576cf5c7445451af37631eea9

SHA1
99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

SHA256
25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

SHA512
c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

Download Submit
\Users\Admin\AppData\Roaming\ndadutou\charnatt.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
\Users\Admin\AppData\Roaming\ndadutou\charnatt.exe

Filesize
234KB

MD5
161e9dc51f67f17f880e57cef13fc156

SHA1
53334572f4cfb8d3b195632d5340e9bdee78bf41

SHA256
f41b8ae2436433756252b7969b1f825b22616293f57d56e70565b85e2c2f14dd

SHA512
ce6db963463a337e2ca32a664de8d6222b0b82f664cf1ad7e09b5cf0fdbffc09384fa31f8d1d3a3f4c9ce67cb1adef64648b55c04c567360e8d8a9c796d640e6

Download Submit
memory/1240-29-0x0000000002A10000-0x0000000002A16000-memory.dmp

Filesize
24KB

Download
memory/1240-34-0x0000000002B90000-0x0000000002B9D000-memory.dmp

Filesize
52KB

Download
memory/1240-24-0x00000000029B0000-0x00000000029FA000-memory.dmp

Filesize
296KB

Download
memory/1240-20-0x00000000029B0000-0x00000000029FA000-memory.dmp

Filesize
296KB

Download
memory/1240-22-0x00000000029B0000-0x00000000029FA000-memory.dmp

Filesize
296KB

Download
memory/1728-18-0x0000000000290000-0x0000000000295000-memory.dmp

Filesize
20KB

Download
memory/1728-21-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1728-15-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2516-10-0x0000000000350000-0x000000000038F000-memory.dmp

Filesize
252KB

Download
memory/2516-33-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2516-1-0x0000000000220000-0x0000000000263000-memory.dmp

Filesize
268KB

Download
memory/2516-14-0x0000000000350000-0x000000000038F000-memory.dmp

Filesize
252KB

Download
memory/2516-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2776-28-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2776-30-0x00000000029B0000-0x00000000029FA000-memory.dmp

Filesize
296KB

Download
memory/2776-37-0x00000000029B0000-0x00000000029FA000-memory.dmp

Filesize
296KB

Download