3de4deb748c454c3c50e6a215bf06cb30b1b3cf2a9e05bd8b702ea3ad180aa69

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

004ce46b062b83b9a686021b9e384527.exe
Size

376KB
MD5

004ce46b062b83b9a686021b9e384527
SHA1

8c3e2a8d85e5fe42abad31f21560494e9d8463ee
SHA256

3de4deb748c454c3c50e6a215bf06cb30b1b3cf2a9e05bd8b702ea3ad180aa69
SHA512

4c89890069ed1b27d5175e1cdd8007b8116ae49fd947e5288c5abc66160bc003c9865fd1cb0a017bca2555b258c1fe1978f727cc8a445a0610fe2442e7375bd0
SSDEEP

6144:zjLg0kpi/JmsGzx/cCYOiUYYBnGm4zwJ2mqeWPt7NK4YGXY0rZhAQN0D:zAlyJtGzdXPiUYYBnGm4k2mqeAt5tXYR

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4400	eheg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{006A0A7F-556D-BCA0-D5D7-574718224D45} = "C:\\Users\\Admin\\AppData\\Roaming\\Goadso\\eheg.exe"	eheg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1344 set thread context of 4896	1344	004ce46b062b83b9a686021b9e384527.exe	93

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe
4400	eheg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4400	1344	004ce46b062b83b9a686021b9e384527.exe	94
PID 1344 wrote to memory of 4400	1344	004ce46b062b83b9a686021b9e384527.exe	94
PID 1344 wrote to memory of 4400	1344	004ce46b062b83b9a686021b9e384527.exe	94
PID 4400 wrote to memory of 2592	4400	eheg.exe	18
PID 4400 wrote to memory of 2592	4400	eheg.exe	18
PID 4400 wrote to memory of 2592	4400	eheg.exe	18
PID 4400 wrote to memory of 2592	4400	eheg.exe	18
PID 4400 wrote to memory of 2592	4400	eheg.exe	18
PID 4400 wrote to memory of 2692	4400	eheg.exe	17
PID 4400 wrote to memory of 2692	4400	eheg.exe	17
PID 4400 wrote to memory of 2692	4400	eheg.exe	17
PID 4400 wrote to memory of 2692	4400	eheg.exe	17
PID 4400 wrote to memory of 2692	4400	eheg.exe	17
PID 4400 wrote to memory of 2800	4400	eheg.exe	14
PID 4400 wrote to memory of 2800	4400	eheg.exe	14
PID 4400 wrote to memory of 2800	4400	eheg.exe	14
PID 4400 wrote to memory of 2800	4400	eheg.exe	14
PID 4400 wrote to memory of 2800	4400	eheg.exe	14
PID 4400 wrote to memory of 3636	4400	eheg.exe	56
PID 4400 wrote to memory of 3636	4400	eheg.exe	56
PID 4400 wrote to memory of 3636	4400	eheg.exe	56
PID 4400 wrote to memory of 3636	4400	eheg.exe	56
PID 4400 wrote to memory of 3636	4400	eheg.exe	56
PID 4400 wrote to memory of 3784	4400	eheg.exe	55
PID 4400 wrote to memory of 3784	4400	eheg.exe	55
PID 4400 wrote to memory of 3784	4400	eheg.exe	55
PID 4400 wrote to memory of 3784	4400	eheg.exe	55
PID 4400 wrote to memory of 3784	4400	eheg.exe	55
PID 4400 wrote to memory of 3956	4400	eheg.exe	54
PID 4400 wrote to memory of 3956	4400	eheg.exe	54
PID 4400 wrote to memory of 3956	4400	eheg.exe	54
PID 4400 wrote to memory of 3956	4400	eheg.exe	54
PID 4400 wrote to memory of 3956	4400	eheg.exe	54
PID 4400 wrote to memory of 4044	4400	eheg.exe	53
PID 4400 wrote to memory of 4044	4400	eheg.exe	53
PID 4400 wrote to memory of 4044	4400	eheg.exe	53
PID 4400 wrote to memory of 4044	4400	eheg.exe	53
PID 4400 wrote to memory of 4044	4400	eheg.exe	53
PID 4400 wrote to memory of 64	4400	eheg.exe	52
PID 4400 wrote to memory of 64	4400	eheg.exe	52
PID 4400 wrote to memory of 64	4400	eheg.exe	52
PID 4400 wrote to memory of 64	4400	eheg.exe	52
PID 4400 wrote to memory of 64	4400	eheg.exe	52
PID 4400 wrote to memory of 2876	4400	eheg.exe	84
PID 4400 wrote to memory of 2876	4400	eheg.exe	84
PID 4400 wrote to memory of 2876	4400	eheg.exe	84
PID 4400 wrote to memory of 2876	4400	eheg.exe	84
PID 4400 wrote to memory of 2876	4400	eheg.exe	84
PID 4400 wrote to memory of 4172	4400	eheg.exe	83
PID 4400 wrote to memory of 4172	4400	eheg.exe	83
PID 4400 wrote to memory of 4172	4400	eheg.exe	83
PID 4400 wrote to memory of 4172	4400	eheg.exe	83
PID 4400 wrote to memory of 4172	4400	eheg.exe	83
PID 4400 wrote to memory of 4508	4400	eheg.exe	82
PID 4400 wrote to memory of 4508	4400	eheg.exe	82
PID 4400 wrote to memory of 4508	4400	eheg.exe	82
PID 4400 wrote to memory of 4508	4400	eheg.exe	82
PID 4400 wrote to memory of 4508	4400	eheg.exe	82
PID 4400 wrote to memory of 1708	4400	eheg.exe	74
PID 4400 wrote to memory of 1708	4400	eheg.exe	74
PID 4400 wrote to memory of 1708	4400	eheg.exe	74
PID 4400 wrote to memory of 1708	4400	eheg.exe	74
PID 4400 wrote to memory of 1708	4400	eheg.exe	74
PID 4400 wrote to memory of 4940	4400	eheg.exe	68

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2692

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2592

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:64

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3784

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3636
- C:\Users\Admin\AppData\Local\Temp\004ce46b062b83b9a686021b9e384527.exe
  "C:\Users\Admin\AppData\Local\Temp\004ce46b062b83b9a686021b9e384527.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa0f90c0b.bat"
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Roaming\Goadso\eheg.exe
    "C:\Users\Admin\AppData\Roaming\Goadso\eheg.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4400

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3076

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3860

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:4940

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4172

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4196

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1152

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2144

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:984

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2908

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3076

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Goadso\eheg.exe

Filesize
376KB

MD5
ffb9f8db79cdbd3d87da6503e9dd9edf

SHA1
0dac773f2a61bce8464776c3bb6cca9cab615c55

SHA256
0db9a4ca351ce6ac0021585e597302e8fbc870d5090b994e1960ad3c9917117e

SHA512
c61a1c8ec72a3fb0226c55c9722d948237dc6bd9a717afef2a4982d7c231d96bc6983b6b0053d1ddd902705ae3a049ff7886621cde225fc4904d8114243f3854

Download Submit
memory/1344-3-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1344-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1344-18-0x0000000002710000-0x0000000002756000-memory.dmp

Filesize
280KB

Download
memory/1344-13-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1344-30-0x0000000002210000-0x0000000002256000-memory.dmp

Filesize
280KB

Download
memory/1344-27-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1344-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1344-20-0x0000000002710000-0x0000000002756000-memory.dmp

Filesize
280KB

Download
memory/1344-12-0x0000000002710000-0x0000000002756000-memory.dmp

Filesize
280KB

Download
memory/1344-14-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1344-1-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1344-15-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1344-0-0x0000000002210000-0x0000000002256000-memory.dmp

Filesize
280KB

Download
memory/1344-16-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1344-17-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/1344-19-0x0000000002710000-0x0000000002756000-memory.dmp

Filesize
280KB

Download
memory/4400-45-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4400-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4400-24-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4400-10-0x00000000020D0000-0x0000000002116000-memory.dmp

Filesize
280KB

Download
memory/4400-44-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4400-43-0x00000000020D0000-0x0000000002116000-memory.dmp

Filesize
280KB

Download
memory/4400-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4896-39-0x0000000000900000-0x0000000000946000-memory.dmp

Filesize
280KB

Download
memory/4896-23-0x0000000000900000-0x0000000000946000-memory.dmp

Filesize
280KB

Download
memory/4896-33-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4896-34-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4896-35-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4896-36-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4896-37-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4896-38-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4896-40-0x0000000000900000-0x0000000000946000-memory.dmp

Filesize
280KB

Download