e3c29b13b412747f75654fe466d7c7a6a5b63087b971d1c922eeb9798b1fe61f

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46c754bc3647321253189a73ac22d559.exe
Size

88KB
MD5

46c754bc3647321253189a73ac22d559
SHA1

040537cba7508e2b6ae01d05d782e791962f1788
SHA256

e3c29b13b412747f75654fe466d7c7a6a5b63087b971d1c922eeb9798b1fe61f
SHA512

c3fdbc1ae8be3792874dba69e3a7adb4a06a5d835fd8874365841346d5266ddebe0b65ccf5dda1c98fb87fc58d6714be62303517048b6d513cad677544a72c72
SSDEEP

1536:xjjJV8fBLXk0/shSdX5Y6ifBTeJ+XMwNfxE3ZOtspqlXBMrgK5aZQ0Gpn8nHyqOS:xXATQA5Y65+8w/E3ZOtKqlzypn8HyLq

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2128	rundll32.exe
1984	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qzoyojudoy = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Wineocs.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2128	2284	46c754bc3647321253189a73ac22d559.exe	19
PID 2284 wrote to memory of 2128	2284	46c754bc3647321253189a73ac22d559.exe	19
PID 2284 wrote to memory of 2128	2284	46c754bc3647321253189a73ac22d559.exe	19
PID 2128 wrote to memory of 1984	2128	rundll32.exe	103
PID 2128 wrote to memory of 1984	2128	rundll32.exe	103
PID 2128 wrote to memory of 1984	2128	rundll32.exe	103

C:\Users\Admin\AppData\Local\Temp\46c754bc3647321253189a73ac22d559.exe
"C:\Users\Admin\AppData\Local\Temp\46c754bc3647321253189a73ac22d559.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Wineocs.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Wineocs.dll",iep
    3⤵
    - Loads dropped DLL
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Wineocs.dll

Filesize
88KB

MD5
e165f0c503846178a995abd53f4fecad

SHA1
a8c2d9f98385e8d93f7fdf0e54ed9744e5b61318

SHA256
e47367f1d0fae4789bfc71cfb762952b6f3aea27587628beb3816a360c716d72

SHA512
33aa6a6bfed8be771315e55c856e5946705cb55fbbd30b9fe043430bb63f1ba6006f4dd9fca147e5ac4571cb87dc47fcfb5ebe8e62b41f946734ca838316a2a9

Download Submit
memory/1984-24-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/1984-23-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/1984-29-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/1984-30-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/1984-26-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2128-16-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2128-25-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2128-8-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2128-9-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2128-11-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2128-7-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2128-17-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2128-22-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2284-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2284-1-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2284-15-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2284-2-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2284-14-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2284-10-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download