Analysis
-
max time kernel
125s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 19:10
Static task
static1
Behavioral task
behavioral1
Sample
66055eb5779265037160e80546c6de3d.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
66055eb5779265037160e80546c6de3d.exe
Resource
win10v2004-20231130-en
General
-
Target
66055eb5779265037160e80546c6de3d.exe
-
Size
6.0MB
-
MD5
66055eb5779265037160e80546c6de3d
-
SHA1
49d3ac6f095af87c2940b16f52f1c72b81646b0d
-
SHA256
6fc7bfc186b8207bcb43a0b012cf8aaa20b9c59ba3582ee48635044abaa1598e
-
SHA512
a315bc889e9f629dd0bb0c8a376ee29f3fcd25706a2ad0511db1292e5d18b76392e857b4db1010b2b1ce6d7ea1f81d94b6dcbcbdd565d456565fa2a36aa152fc
-
SSDEEP
98304:wUQqpYQUHxoPmuVk77pC9RwQic/WkkQldxy6Qn3g64UFkcSJNsPGw7Wb/DibBZNY:wjqi+PS7Qf+OdkExPTpUC+Gwqb/DiNzY
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exedescription pid process target process PID 4800 created 3428 4800 66055eb5779265037160e80546c6de3d.exe Explorer.EXE -
Executes dropped EXE 1 IoCs
Processes:
VCDDaemon.exepid process 4660 VCDDaemon.exe -
Loads dropped DLL 3 IoCs
Processes:
VCDDaemon.exepid process 4660 VCDDaemon.exe 4660 VCDDaemon.exe 4660 VCDDaemon.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
VCDDaemon.execmd.exedescription pid process target process PID 4660 set thread context of 1816 4660 VCDDaemon.exe cmd.exe PID 1816 set thread context of 1476 1816 cmd.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exeVCDDaemon.execmd.exeMSBuild.exepid process 4800 66055eb5779265037160e80546c6de3d.exe 4800 66055eb5779265037160e80546c6de3d.exe 4660 VCDDaemon.exe 4660 VCDDaemon.exe 1816 cmd.exe 1816 cmd.exe 1476 MSBuild.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
VCDDaemon.execmd.exepid process 4660 VCDDaemon.exe 1816 cmd.exe 1816 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1476 MSBuild.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exepid process 4800 66055eb5779265037160e80546c6de3d.exe 4800 66055eb5779265037160e80546c6de3d.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
66055eb5779265037160e80546c6de3d.exeVCDDaemon.execmd.exedescription pid process target process PID 4800 wrote to memory of 4660 4800 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 4800 wrote to memory of 4660 4800 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 4800 wrote to memory of 4660 4800 66055eb5779265037160e80546c6de3d.exe VCDDaemon.exe PID 4660 wrote to memory of 1816 4660 VCDDaemon.exe cmd.exe PID 4660 wrote to memory of 1816 4660 VCDDaemon.exe cmd.exe PID 4660 wrote to memory of 1816 4660 VCDDaemon.exe cmd.exe PID 4660 wrote to memory of 1816 4660 VCDDaemon.exe cmd.exe PID 1816 wrote to memory of 1476 1816 cmd.exe MSBuild.exe PID 1816 wrote to memory of 1476 1816 cmd.exe MSBuild.exe PID 1816 wrote to memory of 1476 1816 cmd.exe MSBuild.exe PID 1816 wrote to memory of 1476 1816 cmd.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66055eb5779265037160e80546c6de3d.exe"C:\Users\Admin\AppData\Local\Temp\66055eb5779265037160e80546c6de3d.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeC:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9a37420dFilesize
2.1MB
MD5f9f44301ee53e691f9a37844a8b096ff
SHA12ec31da35b48119731b05966a59cb457e08fb91e
SHA25620462243f97daca46f4ac267e0c7d04dc25ca84b2169e1fa82afceaa57fcd564
SHA512d90ab5448a65656265b6013eb8140f7c8135964b19a9dd9f9c730bb6fa2cf0e049bdb3bc877c4a5948ae7f847cbd8f0012f377abaa7992341be0b45f41aefbca
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyCDIO.dllFilesize
93KB
MD55abcd9f2323d7e4ac51728cc32f17cc6
SHA1b226b10309a38cb1e30a00bce541cbf62e3dc0e0
SHA256cff34dfd4251c22458f73674e6d2e1ca4c38a2ca7d69491db291e89c929d823b
SHA5123b87c46047611fb491e82b6903694567965fc475337c437098b124679b231bfe47add75537fef26c78d8b87844700eca414c4d9e3f5a065d7f54286cb4f69254
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyCDIO.dllFilesize
93KB
MD55abcd9f2323d7e4ac51728cc32f17cc6
SHA1b226b10309a38cb1e30a00bce541cbf62e3dc0e0
SHA256cff34dfd4251c22458f73674e6d2e1ca4c38a2ca7d69491db291e89c929d823b
SHA5123b87c46047611fb491e82b6903694567965fc475337c437098b124679b231bfe47add75537fef26c78d8b87844700eca414c4d9e3f5a065d7f54286cb4f69254
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyCDIO.dllFilesize
93KB
MD55abcd9f2323d7e4ac51728cc32f17cc6
SHA1b226b10309a38cb1e30a00bce541cbf62e3dc0e0
SHA256cff34dfd4251c22458f73674e6d2e1ca4c38a2ca7d69491db291e89c929d823b
SHA5123b87c46047611fb491e82b6903694567965fc475337c437098b124679b231bfe47add75537fef26c78d8b87844700eca414c4d9e3f5a065d7f54286cb4f69254
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyVCD.dllFilesize
130KB
MD5aa490720cd3c26eff6e6fbe9601673a5
SHA1e97dbbd6b37bff2c700e1ce967cf6612fddfbd41
SHA256349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df
SHA512fb2347bd7d6f0408235f30468886da8e4ec4790058ed70dbb28a4080b399a9b55902aa33756209cb3ed8579347ca69d484cb12f6e7ef0120246c3ac37ef98647
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyVCD.dllFilesize
130KB
MD5aa490720cd3c26eff6e6fbe9601673a5
SHA1e97dbbd6b37bff2c700e1ce967cf6612fddfbd41
SHA256349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df
SHA512fb2347bd7d6f0408235f30468886da8e4ec4790058ed70dbb28a4080b399a9b55902aa33756209cb3ed8579347ca69d484cb12f6e7ef0120246c3ac37ef98647
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
C:\Users\Admin\AppData\Roaming\msdt\poppet.epsFilesize
1.8MB
MD5d0a7fae3a0fdae716c76300adf70b2bb
SHA15be0788226f428dcc66de7aa4dce5d8eeb832d8e
SHA256f1d7eb55fcaf9a6f71316559e33d40682f47ce3c0b1c1ff4908c71ca1015c9ed
SHA5121306f6fba2386a31dffb80297a089285f3045b1c19950a1068a5a3103f06467cda71650c23efc0ba59fd3e35482d1fe362f7713e2f8da965fed97151f85cd5a1
-
memory/1476-42-0x0000029BB1000000-0x0000029BB1010000-memory.dmpFilesize
64KB
-
memory/1476-36-0x00007FFFAA7E0000-0x00007FFFABE57000-memory.dmpFilesize
22.5MB
-
memory/1476-40-0x0000000000400000-0x0000000000578000-memory.dmpFilesize
1.5MB
-
memory/1476-41-0x00007FFFA9D10000-0x00007FFFAA7D1000-memory.dmpFilesize
10.8MB
-
memory/1476-43-0x00007FFFA9D10000-0x00007FFFAA7D1000-memory.dmpFilesize
10.8MB
-
memory/1476-44-0x0000029BB1000000-0x0000029BB1010000-memory.dmpFilesize
64KB
-
memory/1476-46-0x00007FFFA9D10000-0x00007FFFAA7D1000-memory.dmpFilesize
10.8MB
-
memory/1816-33-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/1816-31-0x00007FFFCC2B0000-0x00007FFFCC4A5000-memory.dmpFilesize
2.0MB
-
memory/1816-37-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/1816-34-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/1816-29-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4660-27-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4660-21-0x0000000000460000-0x0000000000478000-memory.dmpFilesize
96KB
-
memory/4660-25-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4660-24-0x00007FFFCC2B0000-0x00007FFFCC4A5000-memory.dmpFilesize
2.0MB
-
memory/4660-23-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4800-12-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4800-0-0x0000000000400000-0x00000000006F1000-memory.dmpFilesize
2.9MB
-
memory/4800-26-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4800-4-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4800-7-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB
-
memory/4800-2-0x00007FFFCC2B0000-0x00007FFFCC4A5000-memory.dmpFilesize
2.0MB
-
memory/4800-1-0x00000000751A0000-0x000000007531B000-memory.dmpFilesize
1.5MB