9109cf2acaaadd902d8a2b6e4655ae849d53865c6899992f6975fd37a56d8963

Analysis

max time kernel
156s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4202894ffe0c73afad4b2d0d59c71c44.exe
Size

36KB
MD5

4202894ffe0c73afad4b2d0d59c71c44
SHA1

9844409fb20fca3332f2dbd16bb1580d4dae47f9
SHA256

9109cf2acaaadd902d8a2b6e4655ae849d53865c6899992f6975fd37a56d8963
SHA512

80501955018260b6ab690acce9f7df0d90455767968b1ccc435c9e087cfb4ff40c4fcd91fdb6d6457bb32649d3fda63435ecd4551141daed8af2448749f2187e
SSDEEP

768:L5uhMogHxJ5CVpm6jFHd+mc+8MfIsVNwDhqpsqc:9FoglCVBjdqz9Nwp0

Score

7^/10

Malware Config

Signatures

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 464 set thread context of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\6MEwGJ.exe	4202894ffe0c73afad4b2d0d59c71c44.exe
File opened for modification	C:\Windows\Fonts\6MEwGJ.exe	4202894ffe0c73afad4b2d0d59c71c44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	4202894ffe0c73afad4b2d0d59c71c44.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3488	4202894ffe0c73afad4b2d0d59c71c44.exe
3488	4202894ffe0c73afad4b2d0d59c71c44.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91
PID 464 wrote to memory of 3488	464	4202894ffe0c73afad4b2d0d59c71c44.exe	91

C:\Users\Admin\AppData\Local\Temp\4202894ffe0c73afad4b2d0d59c71c44.exe
"C:\Users\Admin\AppData\Local\Temp\4202894ffe0c73afad4b2d0d59c71c44.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\4202894ffe0c73afad4b2d0d59c71c44.exe
  C:\Users\Admin\AppData\Local\Temp\4202894ffe0c73afad4b2d0d59c71c44.exe
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3488-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3488-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3488-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3488-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3488-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download