16cfd24009facb5b042fdeb1729c528bd718224b2952aac4068e633eaf33015c

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e227c4f87cd87a8ce5f55aabf1be9fd.exe
Size

316KB
MD5

3e227c4f87cd87a8ce5f55aabf1be9fd
SHA1

527cd2035b0c820906a38b5607939c9f3c8eaac5
SHA256

16cfd24009facb5b042fdeb1729c528bd718224b2952aac4068e633eaf33015c
SHA512

9d21b883febdb61dcf42e3c35cbefab9aec722a43a7a1f1069e32a3a748261631161cd128913c4638c52d7eebe59f7e498c09ea48a4869dde7968011914cf12e
SSDEEP

6144:wRsZwBAllS+PuDsI+fwkaiCqtBrQcfUflEhOK9bx6r4JI0T:wRYBWsI+fva9qfrQCvOK9bxyuhT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2252	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2880	dozgbcrntn.exe

Loads dropped DLL 3 IoCs

pid	Process
2252	cmd.exe
2252	cmd.exe
2880	dozgbcrntn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2764	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2848	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe
2880	dozgbcrntn.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2252	2852	3e227c4f87cd87a8ce5f55aabf1be9fd.exe	28
PID 2852 wrote to memory of 2252	2852	3e227c4f87cd87a8ce5f55aabf1be9fd.exe	28
PID 2852 wrote to memory of 2252	2852	3e227c4f87cd87a8ce5f55aabf1be9fd.exe	28
PID 2852 wrote to memory of 2252	2852	3e227c4f87cd87a8ce5f55aabf1be9fd.exe	28
PID 2252 wrote to memory of 2764	2252	cmd.exe	30
PID 2252 wrote to memory of 2764	2252	cmd.exe	30
PID 2252 wrote to memory of 2764	2252	cmd.exe	30
PID 2252 wrote to memory of 2764	2252	cmd.exe	30
PID 2252 wrote to memory of 2848	2252	cmd.exe	32
PID 2252 wrote to memory of 2848	2252	cmd.exe	32
PID 2252 wrote to memory of 2848	2252	cmd.exe	32
PID 2252 wrote to memory of 2848	2252	cmd.exe	32
PID 2252 wrote to memory of 2880	2252	cmd.exe	33
PID 2252 wrote to memory of 2880	2252	cmd.exe	33
PID 2252 wrote to memory of 2880	2252	cmd.exe	33
PID 2252 wrote to memory of 2880	2252	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\3e227c4f87cd87a8ce5f55aabf1be9fd.exe
"C:\Users\Admin\AppData\Local\Temp\3e227c4f87cd87a8ce5f55aabf1be9fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2852 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3e227c4f87cd87a8ce5f55aabf1be9fd.exe" & start C:\Users\Admin\AppData\Local\DOZGBC~1.EXE -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 2852
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:2848
- - C:\Users\Admin\AppData\Local\dozgbcrntn.exe
    C:\Users\Admin\AppData\Local\DOZGBC~1.EXE -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\dozgbcrntn.exe

Filesize
316KB

MD5
3e227c4f87cd87a8ce5f55aabf1be9fd

SHA1
527cd2035b0c820906a38b5607939c9f3c8eaac5

SHA256
16cfd24009facb5b042fdeb1729c528bd718224b2952aac4068e633eaf33015c

SHA512
9d21b883febdb61dcf42e3c35cbefab9aec722a43a7a1f1069e32a3a748261631161cd128913c4638c52d7eebe59f7e498c09ea48a4869dde7968011914cf12e

Download Submit
memory/2852-0-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2852-1-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2852-2-0x0000000000560000-0x0000000000562000-memory.dmp

Filesize
8KB

Download
memory/2852-4-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-10-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2880-9-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-12-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-13-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-14-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-15-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-16-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-17-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-18-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download
memory/2880-19-0x0000000001000000-0x00000000010B7000-memory.dmp

Filesize
732KB

Download