Analysis
-
max time kernel
161s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:25
Behavioral task
behavioral1
Sample
0b92b052457511c214db0b8f2faf0c30.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b92b052457511c214db0b8f2faf0c30.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
0b92b052457511c214db0b8f2faf0c30.exe
-
Size
955KB
-
MD5
0b92b052457511c214db0b8f2faf0c30
-
SHA1
95d8b72b8a700a88ad5cebc591abe626c7507735
-
SHA256
0c4cd60a8770e657c3dc4d160d99bf29f8481226890f362580d3c3a729ccc3a6
-
SHA512
4f8cce68b9c6971455ac07a9c0fdd13b60edd9c257546bfde975dae66ea60fba1010f4f6d658bb048901211a3a8f2cd52c4026192a4291796d3f6448fa8ac9e1
-
SSDEEP
12288:JYlRFHBdIwCDrA6hWVz0v/Cya+sNzaOvoJpaz/g/J/vVWyM:ulzhOwCDE6hCOo+sNH8az/g/J/NWy
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\pcidump.sys 0b92b052457511c214db0b8f2faf0c30.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 240702203.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 0b92b052457511c214db0b8f2faf0c30.exe -
Executes dropped EXE 1 IoCs
pid Process 5060 240702203.exe -
Loads dropped DLL 2 IoCs
pid Process 3280 rundll32.exe 5060 240702203.exe -
resource yara_rule behavioral2/memory/1852-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1852-1-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1852-30-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360Soft = "C:\\Windows\\system32\\scvhost.exe" 240702203.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\240702203.exe 0b92b052457511c214db0b8f2faf0c30.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\fonts\pci.sys rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe 1852 0b92b052457511c214db0b8f2faf0c30.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1852 0b92b052457511c214db0b8f2faf0c30.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 1852 0b92b052457511c214db0b8f2faf0c30.exe Token: SeDebugPrivilege 3280 rundll32.exe Token: SeDebugPrivilege 3280 rundll32.exe Token: SeDebugPrivilege 5060 240702203.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1852 wrote to memory of 3280 1852 0b92b052457511c214db0b8f2faf0c30.exe 94 PID 1852 wrote to memory of 3280 1852 0b92b052457511c214db0b8f2faf0c30.exe 94 PID 1852 wrote to memory of 3280 1852 0b92b052457511c214db0b8f2faf0c30.exe 94 PID 1852 wrote to memory of 5060 1852 0b92b052457511c214db0b8f2faf0c30.exe 97 PID 1852 wrote to memory of 5060 1852 0b92b052457511c214db0b8f2faf0c30.exe 97 PID 1852 wrote to memory of 5060 1852 0b92b052457511c214db0b8f2faf0c30.exe 97 PID 1852 wrote to memory of 3976 1852 0b92b052457511c214db0b8f2faf0c30.exe 98 PID 1852 wrote to memory of 3976 1852 0b92b052457511c214db0b8f2faf0c30.exe 98 PID 1852 wrote to memory of 3976 1852 0b92b052457511c214db0b8f2faf0c30.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b92b052457511c214db0b8f2faf0c30.exe"C:\Users\Admin\AppData\Local\Temp\0b92b052457511c214db0b8f2faf0c30.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\240676687.dll testall2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3280
-
-
C:\Windows\SysWOW64\240702203.exe"C:\Windows\system32\240702203.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kl78a.bat" "2⤵PID:3976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5962cab8783e4346bf2fd5ac1530a820e
SHA1e5fa0795fafc737f13746ef09b63549bf965a627
SHA256d443d789343c7509885062da36ca881c436bb4a0ff2e1facde138727b5c5699a
SHA5125047c747925f6fc792b6929d19706fed5517a002a8bbf5a7c69d3142e5614b80b53c02b585846002a17e8433cf7c415852bda4abeaa77745c4048c376c6301af
-
Filesize
2KB
MD502d9d918fa8b60987185a61ce70cc334
SHA15425ad813a105fd0ddf3ee0308007fcfb3d65373
SHA2565d4f091e6c30078388efe7609645cbd36c115b14fcca7d400b1ed0c3c1b3cd2d
SHA51200f7f6f979998884256a28b18774a83e4be675dda96f86dcf77b84f4a78a96ed2c998c86a9a2af182c31c8f07e6c00a4e854b0257b89a6d873b1747bd3b12cbd
-
Filesize
4.3MB
MD56c7cdd25c2cb0073306eb22aebfc663f
SHA1a1eba8ab49272b9852fe6a543677e8af36271248
SHA25658280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
SHA51217344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
-
Filesize
12KB
MD5a8528adb7b7c714cd966df5dcbf3e0af
SHA1443ecbe1be975c3249f8817f6041556bbc52a82a
SHA256140b915394135458d28f68d58bcd304d23bbbfe94fb06e817e951f96c59be823
SHA51222a673ea4f75d4864de5846bc7901b88399fbad7fe8ef4fd325b6e46a81c13919df2238cde100ae83dff4ffafcca8805ca1734d516f36ebd4ccaa91278562b4e