Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 19:10
Static task
static1
Behavioral task
behavioral1
Sample
66055eb5779265037160e80546c6de3d.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
66055eb5779265037160e80546c6de3d.exe
Resource
win10v2004-20231130-en
General
-
Target
66055eb5779265037160e80546c6de3d.exe
-
Size
6.0MB
-
MD5
66055eb5779265037160e80546c6de3d
-
SHA1
49d3ac6f095af87c2940b16f52f1c72b81646b0d
-
SHA256
6fc7bfc186b8207bcb43a0b012cf8aaa20b9c59ba3582ee48635044abaa1598e
-
SHA512
a315bc889e9f629dd0bb0c8a376ee29f3fcd25706a2ad0511db1292e5d18b76392e857b4db1010b2b1ce6d7ea1f81d94b6dcbcbdd565d456565fa2a36aa152fc
-
SSDEEP
98304:wUQqpYQUHxoPmuVk77pC9RwQic/WkkQldxy6Qn3g64UFkcSJNsPGw7Wb/DibBZNY:wjqi+PS7Qf+OdkExPTpUC+Gwqb/DiNzY
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exedescription pid process target process PID 1168 created 1268 1168 66055eb5779265037160e80546c6de3d.exe Explorer.EXE -
Executes dropped EXE 1 IoCs
Processes:
VCDDaemon.exepid process 2964 VCDDaemon.exe -
Loads dropped DLL 5 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exeVCDDaemon.execmd.exepid process 1168 66055eb5779265037160e80546c6de3d.exe 1168 66055eb5779265037160e80546c6de3d.exe 2964 VCDDaemon.exe 2964 VCDDaemon.exe 2584 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
VCDDaemon.exedescription pid process target process PID 2964 set thread context of 2584 2964 VCDDaemon.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exeVCDDaemon.execmd.exepid process 1168 66055eb5779265037160e80546c6de3d.exe 1168 66055eb5779265037160e80546c6de3d.exe 2964 VCDDaemon.exe 2964 VCDDaemon.exe 2584 cmd.exe 2584 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
VCDDaemon.execmd.exepid process 2964 VCDDaemon.exe 2584 cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exepid process 1168 66055eb5779265037160e80546c6de3d.exe 1168 66055eb5779265037160e80546c6de3d.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exeVCDDaemon.execmd.exedescription pid process target process PID 1168 wrote to memory of 2964 1168 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 1168 wrote to memory of 2964 1168 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 1168 wrote to memory of 2964 1168 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 1168 wrote to memory of 2964 1168 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 2964 wrote to memory of 2584 2964 VCDDaemon.exe cmd.exe PID 2964 wrote to memory of 2584 2964 VCDDaemon.exe cmd.exe PID 2964 wrote to memory of 2584 2964 VCDDaemon.exe cmd.exe PID 2964 wrote to memory of 2584 2964 VCDDaemon.exe cmd.exe PID 2964 wrote to memory of 2584 2964 VCDDaemon.exe cmd.exe PID 2584 wrote to memory of 2732 2584 cmd.exe MSBuild.exe PID 2584 wrote to memory of 2732 2584 cmd.exe MSBuild.exe PID 2584 wrote to memory of 2732 2584 cmd.exe MSBuild.exe PID 2584 wrote to memory of 2732 2584 cmd.exe MSBuild.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\66055eb5779265037160e80546c6de3d.exe"C:\Users\Admin\AppData\Local\Temp\66055eb5779265037160e80546c6de3d.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeC:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\24e5d1b6Filesize
2.1MB
MD5acdcad9a52e8cebe52e680e38946924f
SHA15a948fb35a4b67d927441d67a70e115228ece83f
SHA256386eb8f0f6ea3ddb1f12f492999d78ca71991b7b8538a8f9d4fd0b62564c014a
SHA51216f3cbe9561e0c5dc1d5cea5ea7f93f3391971ad70428dbc9496432eebe590f812a477d42ff36e72595b7c418fb6a42c41c6b4d322e7a3f0e437f25bb993e75a
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyCDIO.dllFilesize
93KB
MD55abcd9f2323d7e4ac51728cc32f17cc6
SHA1b226b10309a38cb1e30a00bce541cbf62e3dc0e0
SHA256cff34dfd4251c22458f73674e6d2e1ca4c38a2ca7d69491db291e89c929d823b
SHA5123b87c46047611fb491e82b6903694567965fc475337c437098b124679b231bfe47add75537fef26c78d8b87844700eca414c4d9e3f5a065d7f54286cb4f69254
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyVCD.dllFilesize
130KB
MD5aa490720cd3c26eff6e6fbe9601673a5
SHA1e97dbbd6b37bff2c700e1ce967cf6612fddfbd41
SHA256349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df
SHA512fb2347bd7d6f0408235f30468886da8e4ec4790058ed70dbb28a4080b399a9b55902aa33756209cb3ed8579347ca69d484cb12f6e7ef0120246c3ac37ef98647
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
C:\Users\Admin\AppData\Roaming\msdt\poppet.epsFilesize
1.8MB
MD5d0a7fae3a0fdae716c76300adf70b2bb
SHA15be0788226f428dcc66de7aa4dce5d8eeb832d8e
SHA256f1d7eb55fcaf9a6f71316559e33d40682f47ce3c0b1c1ff4908c71ca1015c9ed
SHA5121306f6fba2386a31dffb80297a089285f3045b1c19950a1068a5a3103f06467cda71650c23efc0ba59fd3e35482d1fe362f7713e2f8da965fed97151f85cd5a1
-
\Users\Admin\AppData\Roaming\msdt\ElbyCDIO.dllFilesize
93KB
MD55abcd9f2323d7e4ac51728cc32f17cc6
SHA1b226b10309a38cb1e30a00bce541cbf62e3dc0e0
SHA256cff34dfd4251c22458f73674e6d2e1ca4c38a2ca7d69491db291e89c929d823b
SHA5123b87c46047611fb491e82b6903694567965fc475337c437098b124679b231bfe47add75537fef26c78d8b87844700eca414c4d9e3f5a065d7f54286cb4f69254
-
\Users\Admin\AppData\Roaming\msdt\ElbyVCD.dllFilesize
130KB
MD5aa490720cd3c26eff6e6fbe9601673a5
SHA1e97dbbd6b37bff2c700e1ce967cf6612fddfbd41
SHA256349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df
SHA512fb2347bd7d6f0408235f30468886da8e4ec4790058ed70dbb28a4080b399a9b55902aa33756209cb3ed8579347ca69d484cb12f6e7ef0120246c3ac37ef98647
-
\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
memory/1168-13-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/1168-1-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/1168-0-0x0000000000400000-0x00000000006F1000-memory.dmpFilesize
2.9MB
-
memory/1168-10-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/1168-7-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/1168-4-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/1168-30-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/1168-2-0x0000000076DF0000-0x0000000076F99000-memory.dmpFilesize
1.7MB
-
memory/2584-85-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/2584-82-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/2584-83-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/2584-33-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/2584-35-0x0000000076DF0000-0x0000000076F99000-memory.dmpFilesize
1.7MB
-
memory/2964-31-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/2964-25-0x0000000000020000-0x0000000000038000-memory.dmpFilesize
96KB
-
memory/2964-28-0x0000000076DF0000-0x0000000076F99000-memory.dmpFilesize
1.7MB
-
memory/2964-29-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB
-
memory/2964-27-0x0000000074410000-0x0000000074584000-memory.dmpFilesize
1.5MB