6fe6ffd93e9ad9944224ec4b47cee94d44ce09e98d832b1d8e16db3ef525e9dd

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

068b3e27aa7512028aa20fa0ef09a5d9.exe
Size

35KB
MD5

068b3e27aa7512028aa20fa0ef09a5d9
SHA1

f75215fde0f8f7cd2e25dfe00a71b1010c1fc53a
SHA256

6fe6ffd93e9ad9944224ec4b47cee94d44ce09e98d832b1d8e16db3ef525e9dd
SHA512

0c05593c65c635b7ad8f66222595dfcc673bb572d122e95e7238ea9cca6c83d90f20c6d3a74b3aa5140eb2b23f86b2389ba6a6f41281da2755fbd39ea4e844a3
SSDEEP

768:0yZaKiQO/wls1dzo7T9DRWPx8p2SivRLAfzb8qL:p/O/wl6kRRSJpLALg2

Score

8^/10

evasion upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
1952	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1952	rundll32.exe
1952	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4500-0-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/4500-17-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DVR0034017.dll	068b3e27aa7512028aa20fa0ef09a5d9.exe
File created	C:\Windows\SysWOW64\chinasougou.ime	068b3e27aa7512028aa20fa0ef09a5d9.exe
File created	C:\Windows\SysWOW64\YUksuser.dll	068b3e27aa7512028aa20fa0ef09a5d9.exe
File created	C:\Windows\SysWOW64\ksuser.dll	068b3e27aa7512028aa20fa0ef09a5d9.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	068b3e27aa7512028aa20fa0ef09a5d9.exe
File created	C:\Windows\SysWOW64\DVR0034017.dll	068b3e27aa7512028aa20fa0ef09a5d9.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4700	sc.exe
1164	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	068b3e27aa7512028aa20fa0ef09a5d9.exe
4500	068b3e27aa7512028aa20fa0ef09a5d9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	068b3e27aa7512028aa20fa0ef09a5d9.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 3904	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	25
PID 4500 wrote to memory of 3904	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	25
PID 4500 wrote to memory of 3904	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	25
PID 4500 wrote to memory of 1164	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	24
PID 4500 wrote to memory of 1164	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	24
PID 4500 wrote to memory of 1164	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	24
PID 4500 wrote to memory of 4700	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	23
PID 4500 wrote to memory of 4700	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	23
PID 4500 wrote to memory of 4700	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	23
PID 4500 wrote to memory of 1952	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	20
PID 4500 wrote to memory of 1952	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	20
PID 4500 wrote to memory of 1952	4500	068b3e27aa7512028aa20fa0ef09a5d9.exe	20
PID 3904 wrote to memory of 1336	3904	net.exe	19
PID 3904 wrote to memory of 1336	3904	net.exe	19
PID 3904 wrote to memory of 1336	3904	net.exe	19

C:\Users\Admin\AppData\Local\Temp\068b3e27aa7512028aa20fa0ef09a5d9.exe
"C:\Users\Admin\AppData\Local\Temp\068b3e27aa7512028aa20fa0ef09a5d9.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1703918209.dat, ServerMain c:\users\admin\appdata\local\temp\068b3e27aa7512028aa20fa0ef09a5d9.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:1952
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  PID:4700
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1164
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop cryptsvc
1⤵
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4500-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4500-17-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download