d1c1b50e061442f29de29991984951ddfeecd26d55a6b21a41812939bd21152c

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c736fdfb95e91847b0c78f6097a8599.exe
Size

652KB
MD5

0c736fdfb95e91847b0c78f6097a8599
SHA1

91f3cbcfec8b63728b2622931759472f77a697d3
SHA256

d1c1b50e061442f29de29991984951ddfeecd26d55a6b21a41812939bd21152c
SHA512

07d78f38dc53dc4a961a714a5e552c6508b1414bb4352e9e8c9dfc68d85b56286c8cca61f80d89767aca0db4211e9f1964c429af2bcad4a442f2d2c703aace87
SSDEEP

12288:YhS38YPyX+AYhn1OTe7lpPHbaBvJS4Waamaa1F3Z4mxxiX2Fi0yT8gsfw:Ys38oyX+Am1O0lFbaZJtaba1QmXTZyws

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2760	aq.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\aq.exe	0c736fdfb95e91847b0c78f6097a8599.exe
File opened for modification	C:\Program Files\aq.exe	0c736fdfb95e91847b0c78f6097a8599.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3876	4088	WerFault.exe	60

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4088	0c736fdfb95e91847b0c78f6097a8599.exe
4088	0c736fdfb95e91847b0c78f6097a8599.exe
2760	aq.exe
2760	aq.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2760	4088	0c736fdfb95e91847b0c78f6097a8599.exe	90
PID 4088 wrote to memory of 2760	4088	0c736fdfb95e91847b0c78f6097a8599.exe	90
PID 4088 wrote to memory of 2760	4088	0c736fdfb95e91847b0c78f6097a8599.exe	90

C:\Users\Admin\AppData\Local\Temp\0c736fdfb95e91847b0c78f6097a8599.exe
"C:\Users\Admin\AppData\Local\Temp\0c736fdfb95e91847b0c78f6097a8599.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\aq.exe
  "C:\Program Files\aq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 492
  2⤵
  - Program crash
  PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4088 -ip 4088
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\aq.exe

Filesize
652KB

MD5
0c736fdfb95e91847b0c78f6097a8599

SHA1
91f3cbcfec8b63728b2622931759472f77a697d3

SHA256
d1c1b50e061442f29de29991984951ddfeecd26d55a6b21a41812939bd21152c

SHA512
07d78f38dc53dc4a961a714a5e552c6508b1414bb4352e9e8c9dfc68d85b56286c8cca61f80d89767aca0db4211e9f1964c429af2bcad4a442f2d2c703aace87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\ÌÚÑ¶QQ.lnk

Filesize
729B

MD5
03bf00de04d3454572d8544cec3a1557

SHA1
3f3ffd70c0ef677ccbc7ca0332726f54eac1fbdd

SHA256
6f78dd6693d88806bcb5a15e6629e9f3b9726732e8ca53d9e40eaad25d4e1f01

SHA512
db26d75e93a9da80f77422b5260970ea47de99c72504702ef0a450a14e1a3027bb6bbb7966c7f8feab1353851fb6478f4e0b6dcff723ff3671c97a3accd26ada

Download Submit
C:\Users\Admin\Desktop\ÌÚÑ¶QQ.lnk

Filesize
705B

MD5
16de3e17e461d96d7e30a0bb76988583

SHA1
31c1d2bec34e43fc67cb14d171f522edd1af54ef

SHA256
1d8ba00556a167ee4d1aa0085c34df2e5eb605e287c45166c2690e07612b4b11

SHA512
69ab9ee7c82d8bb89bd2d94875a4a12a0ddf3cb547415d4724763e8c36ccf78864b6791a4eea89bdd055d832c10b1c8a27fc11a9184dee2abf87f796ec5939ec

Download Submit
memory/2760-133-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2760-117-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2760-109-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/4088-35-0x00000000036F0000-0x00000000036F1000-memory.dmp

Filesize
4KB

Download
memory/4088-19-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/4088-11-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/4088-10-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/4088-9-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/4088-8-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/4088-7-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/4088-6-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4088-14-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/4088-15-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/4088-16-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4088-17-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/4088-18-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/4088-4-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/4088-20-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/4088-21-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/4088-22-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/4088-23-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/4088-24-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/4088-25-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/4088-26-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/4088-28-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/4088-27-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/4088-30-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/4088-31-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/4088-29-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/4088-32-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/4088-34-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/4088-33-0x00000000035E0000-0x00000000035E1000-memory.dmp

Filesize
4KB

Download
memory/4088-0-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/4088-66-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/4088-13-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/4088-63-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/4088-12-0x00000000034D0000-0x00000000034D2000-memory.dmp

Filesize
8KB

Download
memory/4088-51-0x0000000003900000-0x0000000003901000-memory.dmp

Filesize
4KB

Download
memory/4088-65-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/4088-64-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/4088-5-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/4088-62-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/4088-61-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/4088-60-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/4088-59-0x0000000004270000-0x0000000004271000-memory.dmp

Filesize
4KB

Download
memory/4088-58-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/4088-54-0x00000000040F0000-0x00000000040F1000-memory.dmp

Filesize
4KB

Download
memory/4088-53-0x0000000003960000-0x0000000003961000-memory.dmp

Filesize
4KB

Download
memory/4088-52-0x0000000003910000-0x0000000003911000-memory.dmp

Filesize
4KB

Download
memory/4088-50-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/4088-49-0x0000000003950000-0x0000000003951000-memory.dmp

Filesize
4KB

Download
memory/4088-48-0x0000000003920000-0x0000000003921000-memory.dmp

Filesize
4KB

Download
memory/4088-47-0x0000000003930000-0x0000000003931000-memory.dmp

Filesize
4KB

Download
memory/4088-46-0x00000000038F0000-0x00000000038F1000-memory.dmp

Filesize
4KB

Download
memory/4088-44-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/4088-45-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/4088-43-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/4088-42-0x0000000003790000-0x0000000003791000-memory.dmp

Filesize
4KB

Download
memory/4088-41-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/4088-40-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/4088-39-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/4088-38-0x0000000003740000-0x0000000003741000-memory.dmp

Filesize
4KB

Download
memory/4088-37-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/4088-36-0x0000000003720000-0x0000000003721000-memory.dmp

Filesize
4KB

Download
memory/4088-3-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/4088-116-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/4088-2-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/4088-131-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/4088-1-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download