4b747f699cdab219152094dd541ebcb6da7e47bbcc8fb33b226b0013d4c7d7f2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be62854618491cb4fe30b2299102bb1b.exe
Size

1.7MB
MD5

be62854618491cb4fe30b2299102bb1b
SHA1

9eefa9228fef11bd0ee3d064f06ab3a91667edcd
SHA256

4b747f699cdab219152094dd541ebcb6da7e47bbcc8fb33b226b0013d4c7d7f2
SHA512

6088d33d9871ee8c1e8d01f18466ca86a21cf89d892dc6f5d07a5dc0eea2dafc570a86352c0b151fd22e471d2f38ccfacca832e40228f2d1f7d3b9e5afb67cb7
SSDEEP

24576:uf1H2XHc6gL75XqyHlXv0L5U+u2C8ZfVLgBdJbREOzdwIgcy9ldmLdGxnPKLnMxp:ufkclLdfKZfByRdsirDc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2764	ndmumaa.exe
2592	ndmumaa.exe
2568	ndmumaa.exe
2636	ndmumaa.exe
2960	ndmumaa.exe
2072	ndmumaa.exe

Loads dropped DLL 5 IoCs

pid	Process
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2900	be62854618491cb4fe30b2299102bb1b.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe
2764	ndmumaa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	ndmumaa.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 1992 wrote to memory of 2900	1992	be62854618491cb4fe30b2299102bb1b.exe	29
PID 2800 wrote to memory of 2764	2800	taskeng.exe	31
PID 2800 wrote to memory of 2764	2800	taskeng.exe	31
PID 2800 wrote to memory of 2764	2800	taskeng.exe	31
PID 2800 wrote to memory of 2764	2800	taskeng.exe	31
PID 2764 wrote to memory of 2568	2764	ndmumaa.exe	32
PID 2764 wrote to memory of 2568	2764	ndmumaa.exe	32
PID 2764 wrote to memory of 2568	2764	ndmumaa.exe	32
PID 2764 wrote to memory of 2568	2764	ndmumaa.exe	32
PID 2764 wrote to memory of 2592	2764	ndmumaa.exe	33
PID 2764 wrote to memory of 2592	2764	ndmumaa.exe	33
PID 2764 wrote to memory of 2592	2764	ndmumaa.exe	33
PID 2764 wrote to memory of 2592	2764	ndmumaa.exe	33
PID 2764 wrote to memory of 2636	2764	ndmumaa.exe	34
PID 2764 wrote to memory of 2636	2764	ndmumaa.exe	34
PID 2764 wrote to memory of 2636	2764	ndmumaa.exe	34
PID 2764 wrote to memory of 2636	2764	ndmumaa.exe	34
PID 2764 wrote to memory of 2960	2764	ndmumaa.exe	35
PID 2764 wrote to memory of 2960	2764	ndmumaa.exe	35
PID 2764 wrote to memory of 2960	2764	ndmumaa.exe	35
PID 2764 wrote to memory of 2960	2764	ndmumaa.exe	35
PID 2764 wrote to memory of 2072	2764	ndmumaa.exe	36
PID 2764 wrote to memory of 2072	2764	ndmumaa.exe	36
PID 2764 wrote to memory of 2072	2764	ndmumaa.exe	36
PID 2764 wrote to memory of 2072	2764	ndmumaa.exe	36

C:\Users\Admin\AppData\Local\Temp\be62854618491cb4fe30b2299102bb1b.exe
"C:\Users\Admin\AppData\Local\Temp\be62854618491cb4fe30b2299102bb1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\be62854618491cb4fe30b2299102bb1b.exe
  "C:\Users\Admin\AppData\Local\Temp\be62854618491cb4fe30b2299102bb1b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900

C:\Windows\system32\taskeng.exe
taskeng.exe {518602C2-F24A-4B96-9F1E-0391A9F249F6} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
  C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
    "C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe"
    3⤵
    - Executes dropped EXE
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
    "C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe"
    3⤵
    - Executes dropped EXE
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
    "C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe"
    3⤵
    - Executes dropped EXE
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
    "C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe"
    3⤵
    - Executes dropped EXE
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe
    "C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe"
    3⤵
    - Executes dropped EXE
    PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ndmumaa.exe

Filesize
1.7MB

MD5
be62854618491cb4fe30b2299102bb1b

SHA1
9eefa9228fef11bd0ee3d064f06ab3a91667edcd

SHA256
4b747f699cdab219152094dd541ebcb6da7e47bbcc8fb33b226b0013d4c7d7f2

SHA512
6088d33d9871ee8c1e8d01f18466ca86a21cf89d892dc6f5d07a5dc0eea2dafc570a86352c0b151fd22e471d2f38ccfacca832e40228f2d1f7d3b9e5afb67cb7

Download Submit
memory/1992-14-0x0000000000C40000-0x0000000000C80000-memory.dmp

Filesize
256KB

Download
memory/1992-2-0x0000000000C40000-0x0000000000C80000-memory.dmp

Filesize
256KB

Download
memory/1992-1-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-3-0x0000000000C40000-0x0000000000C80000-memory.dmp

Filesize
256KB

Download
memory/1992-34-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/1992-0-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-21-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-19-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-20-0x0000000002040000-0x0000000002080000-memory.dmp

Filesize
256KB

Download
memory/2764-22-0x0000000002040000-0x0000000002080000-memory.dmp

Filesize
256KB

Download
memory/2764-33-0x0000000002040000-0x0000000002080000-memory.dmp

Filesize
256KB

Download
memory/2764-35-0x0000000074370000-0x000000007491B000-memory.dmp

Filesize
5.7MB

Download
memory/2900-12-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2900-13-0x0000000000610000-0x000000000085F000-memory.dmp

Filesize
2.3MB

Download
memory/2900-10-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2900-15-0x0000000000860000-0x0000000000AE0000-memory.dmp

Filesize
2.5MB

Download
memory/2900-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2900-6-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2900-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download