4e6bad1b5cc7f890558bc3ff6c2e3939eb36371b6975ff3585151c6607dd25c7

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
19/11/2023, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888.dll
Size

912KB
MD5

d24b38a543bfbb715b93e9059a79ada5
SHA1

af4b41a4ddd99d866360160f755a5f55fc8f35f0
SHA256

c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888
SHA512

abceb1d12fc00678b63d2439341e04bdee65952230ebd6ba674d9a9b8b6fccea04fed1e4b9f1c8f2064c944b7f5b8d71749a7b2b343923d335a8bd03b5eb3830
SSDEEP

12288:v+YE32Q8n9FgCBT4jh0rOcazvLbzTq4TYSyPKcaTuxfa:vvEwnfg04jgaXbzG4TYS8KcR

Score

7^/10

evasion persistence trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1344	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\Brtwovgetqxkjn = "C:\\Users\\Admin\\AppData\\Roaming\\p0aBp\\sethc.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\rNkY\unregmp2.exe	cmd.exe
File opened for modification	C:\Windows\system32\rNkY\unregmp2.exe	cmd.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1576	rundll32.exe
1576	rundll32.exe
1576	rundll32.exe
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found
1344	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1344	Process not Found

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 2548	1344	Process not Found	28
PID 1344 wrote to memory of 2548	1344	Process not Found	28
PID 1344 wrote to memory of 2548	1344	Process not Found	28
PID 1344 wrote to memory of 2368	1344	Process not Found	29
PID 1344 wrote to memory of 2368	1344	Process not Found	29
PID 1344 wrote to memory of 2368	1344	Process not Found	29
PID 1344 wrote to memory of 1512	1344	Process not Found	31
PID 1344 wrote to memory of 1512	1344	Process not Found	31
PID 1344 wrote to memory of 1512	1344	Process not Found	31
PID 1344 wrote to memory of 2012	1344	Process not Found	32
PID 1344 wrote to memory of 2012	1344	Process not Found	32
PID 1344 wrote to memory of 2012	1344	Process not Found	32
PID 1344 wrote to memory of 1748	1344	Process not Found	34
PID 1344 wrote to memory of 1748	1344	Process not Found	34
PID 1344 wrote to memory of 1748	1344	Process not Found	34
PID 1344 wrote to memory of 1532	1344	Process not Found	38
PID 1344 wrote to memory of 1532	1344	Process not Found	38
PID 1344 wrote to memory of 1532	1344	Process not Found	38
PID 1344 wrote to memory of 1508	1344	Process not Found	40
PID 1344 wrote to memory of 1508	1344	Process not Found	40
PID 1344 wrote to memory of 1508	1344	Process not Found	40
PID 1344 wrote to memory of 2296	1344	Process not Found	42
PID 1344 wrote to memory of 2296	1344	Process not Found	42
PID 1344 wrote to memory of 2296	1344	Process not Found	42
PID 1344 wrote to memory of 992	1344	Process not Found	44
PID 1344 wrote to memory of 992	1344	Process not Found	44
PID 1344 wrote to memory of 992	1344	Process not Found	44
PID 1344 wrote to memory of 1112	1344	Process not Found	47
PID 1344 wrote to memory of 1112	1344	Process not Found	47
PID 1344 wrote to memory of 1112	1344	Process not Found	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1576

C:\Windows\system32\sethc.exe
C:\Windows\system32\sethc.exe
1⤵
PID:2548

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\0mct.cmd
1⤵
PID:2368

C:\Windows\system32\unregmp2.exe
C:\Windows\system32\unregmp2.exe
1⤵
PID:1512

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\YOzYb.cmd
1⤵
- Drops file in System32 directory
PID:2012

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /F /TN "Zulhjuyrr" /TR C:\Windows\system32\rNkY\unregmp2.exe /SC minute /MO 60 /RL highest
1⤵
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Zulhjuyrr"
1⤵
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Zulhjuyrr"
1⤵
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Zulhjuyrr"
1⤵
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Zulhjuyrr"
1⤵
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /Query /TN "Zulhjuyrr"
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0mct.cmd

Filesize
226B

MD5
28a9702102176fc50e153d9ad3f2305f

SHA1
0c962fd8229c0c3bbb5839cade2ee31bc7e6bba8

SHA256
71c15d4ce1077317d2739ff1e4b5d7652f63837e672dbd69f7a032403939ff80

SHA512
579fbb5931f20df3f2fd8f2e22bfe1393d31ba1453412589e1b4ab6ebf61533ff49c8fa05382b44e4a2929d203ca3f55988fc13d5711972c530194daced1c571

Download Submit
C:\Users\Admin\AppData\Local\Temp\YOzYb.cmd

Filesize
195B

MD5
4007d9c9144bf845789c835034cd6bae

SHA1
a0a2ed9cf7a8628758350c8ed514c033f150090e

SHA256
5cc04ce3c315966647c68b16177772215cac525a13690685e4b805f88354c515

SHA512
26865a46b0f28bb8222e47d4d13dec78c2a061618a65f9c0a389ead7e0226f36b6ce917d27035e1f7fa6e43536d8bdf6edd3233fd6c6586cd12f20e53866d32e

Download Submit
C:\Users\Admin\AppData\Local\Temp\p7B67.tmp

Filesize
916KB

MD5
c46de1ae040ff25d2f18f051d3a248e2

SHA1
3838dd06278bfe163dd2b8bfedda8a6b97b169bb

SHA256
c3532d6592075a2c83f99a2d1d5dffd6d382569f581738cd3c3f305f1899839e

SHA512
c51e60021d9f6e91110550997d8dff3b578ccf0dfcbce125f388f544cb27e7e89ad124f7ae27e6485615e90ffd2446da14e701c8f7fcdae5d4e985380b08abd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\vU4A4A9.tmp

Filesize
916KB

MD5
7edb7d1bf020aa95b8d8cbecd3614777

SHA1
f4c9b14902141dc2e1f4ffa7356df1998d04a263

SHA256
6254821165d0051ddf8f588dd23c58c920b0f1f85114a0331f89e7ac74fb5715

SHA512
288201e498776a44ffc4dca0e864063c6ab9a11fca9da76a0f3e5bf3fdc76cf6ac51797b5979044236a1ad23d8f5f234694a144ce70a52ba8d7ecefaa97a2460

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Brtwovgetqxkjn.lnk

Filesize
774B

MD5
28e2f57dbc78151a830c46018fd113e6

SHA1
821145d27d46be3aab4d361498d1fd0a43094550

SHA256
4ea7f34e44133f5fdbbfd220263f625dc7fe448ef91c10a35542e9913457bcd3

SHA512
6fd64728bbeaa1a3d8c293d9d29597be586b7d061a3ac9e68e56f6c8192bdc8f7cc80b797a4d0ffb8a094f455d13f234d791aad4cdf96c02f2e1f0de6228b052

Download Submit
C:\Users\Admin\AppData\Roaming\p0aBp\sethc.exe

Filesize
272KB

MD5
3bcb70da9b5a2011e01e35ed29a3f3f3

SHA1
9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

SHA256
dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

SHA512
69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

Download Submit
\Users\Admin\AppData\Roaming\p0aBp\sethc.exe

Filesize
272KB

MD5
3bcb70da9b5a2011e01e35ed29a3f3f3

SHA1
9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

SHA256
dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

SHA512
69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

Download Submit
memory/1344-63-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-52-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-19-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-20-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-61-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-23-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-25-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-26-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-28-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-30-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-31-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-32-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-34-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-35-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-38-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-39-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-42-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-44-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-45-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-47-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-48-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-50-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-54-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-53-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-55-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-56-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-58-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-60-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-62-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-3-0x0000000077686000-0x0000000077687000-memory.dmp

Filesize
4KB

Download
memory/1344-65-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-64-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-21-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-17-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-15-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-59-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-51-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-49-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-46-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-43-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-41-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-40-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-37-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-36-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-33-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-29-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-27-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-24-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-22-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-18-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-16-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-13-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-10-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-6-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-79-0x0000000002680000-0x0000000002688000-memory.dmp

Filesize
32KB

Download
memory/1344-88-0x0000000077891000-0x0000000077892000-memory.dmp

Filesize
4KB

Download
memory/1344-89-0x00000000779F0000-0x00000000779F2000-memory.dmp

Filesize
8KB

Download
memory/1344-57-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-14-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-12-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-11-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-119-0x0000000077686000-0x0000000077687000-memory.dmp

Filesize
4KB

Download
memory/1344-9-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-7-0x0000000140000000-0x00000001400E4000-memory.dmp

Filesize
912KB

Download
memory/1344-4-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1576-0-0x000007FEF6730000-0x000007FEF6814000-memory.dmp

Filesize
912KB

Download
memory/1576-1-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/1576-8-0x000007FEF6730000-0x000007FEF6814000-memory.dmp

Filesize
912KB

Download