Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 22:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ef4b5923a1e1352a37710e7e2a3bbb8.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ef4b5923a1e1352a37710e7e2a3bbb8.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
3ef4b5923a1e1352a37710e7e2a3bbb8.exe
-
Size
172KB
-
MD5
3ef4b5923a1e1352a37710e7e2a3bbb8
-
SHA1
4861d809c266da77711338ef1f8c90139e4ffb97
-
SHA256
c00e51827f9bc6f1f2327aac2e523cf64f3eddedab26e40482c8e16818a0e887
-
SHA512
52d9f673c464d3bb419488c6155631e9454468beb747bc82c01d980bdf72c1967663e3e69b37dfe1f0eb88c1663c1a7b39f213adf0e2ab749bf5141462d71c9f
-
SSDEEP
3072:7Zh8mBkV3lKjInFFRzb9fLcU4rzxr5h8:Fh8EkV3AjiFFh9zcjrzxr5
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4840-1-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/3856-3-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-16541-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-37772-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-47750-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-58975-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-80843-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-100136-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/4840-100143-0x0000000000400000-0x0000000000477000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMIMZMHMFM = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3ef4b5923a1e1352a37710e7e2a3bbb8.exe" 3ef4b5923a1e1352a37710e7e2a3bbb8.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job 3ef4b5923a1e1352a37710e7e2a3bbb8.exe File opened for modification C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job 3ef4b5923a1e1352a37710e7e2a3bbb8.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\International 3ef4b5923a1e1352a37710e7e2a3bbb8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 3856 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 4840 3ef4b5923a1e1352a37710e7e2a3bbb8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3856 wrote to memory of 4840 3856 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 86 PID 3856 wrote to memory of 4840 3856 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 86 PID 3856 wrote to memory of 4840 3856 3ef4b5923a1e1352a37710e7e2a3bbb8.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ef4b5923a1e1352a37710e7e2a3bbb8.exe"C:\Users\Admin\AppData\Local\Temp\3ef4b5923a1e1352a37710e7e2a3bbb8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\3ef4b5923a1e1352a37710e7e2a3bbb8.exeC:\Users\Admin\AppData\Local\Temp\3ef4b5923a1e1352a37710e7e2a3bbb8.exe2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4840
-