3b2fe5b25121c29060af83a612ea763e7e4669b7b1979c6acf498e89ac7bb48b

Analysis

max time kernel
114s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13bd24e2d8b1f8555ac7519d27756206.exe
Size

89KB
MD5

13bd24e2d8b1f8555ac7519d27756206
SHA1

0f4a03d41e5d41aeff4d343d5a10e40aec2bbac5
SHA256

3b2fe5b25121c29060af83a612ea763e7e4669b7b1979c6acf498e89ac7bb48b
SHA512

c95a9a19cd63d7657851f02306dc063980bf34c14039b43261a3bfb45c33c6f2ff096341be867498bdfbf3e53135993a4410d2600abc23d6bb491ba555dbb7cc
SSDEEP

1536:+vQApS38LPJWUirnX/0eroTAe02GuS/j/s1WdDRSBtD4mCkpzvq:upS3CAnP0pD02LSzsInSjsmCkp+

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\herss.exe"	13bd24e2d8b1f8555ac7519d27756206.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	2524	WerFault.exe	54

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe
2524	13bd24e2d8b1f8555ac7519d27756206.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 3496	2524	13bd24e2d8b1f8555ac7519d27756206.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3496
- C:\Users\Admin\AppData\Local\Temp\13bd24e2d8b1f8555ac7519d27756206.exe
  "C:\Users\Admin\AppData\Local\Temp\13bd24e2d8b1f8555ac7519d27756206.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 372
    3⤵
    - Program crash
    PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2524 -ip 2524
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvasds0.dll

Filesize
88KB

MD5
820a8ff24e4a851e49ca2599bd70c883

SHA1
a745e5d84f9b9657e0910ad1dcbefd94d66fb575

SHA256
f2f7bb6c89458dc71c1ff1260a029336d849dcb463a1a289fcda27286f83aa37

SHA512
43d8e2a94676c2456b7e355b4bf37760ac7400f973238041987649af1eede0d2b116adf6f3bce07e4a53191d380991730410301d926444183c7546e38f265187

Download Submit
memory/2524-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2524-4-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2524-10-0x0000000010000000-0x0000000010070000-memory.dmp

Filesize
448KB

Download
memory/2524-11-0x0000000010000000-0x0000000010070000-memory.dmp

Filesize
448KB

Download