3d0c6513970d62e3b375101b3d0ad48f30ef17488bf2f0de8b3a1a100ab52eb1

Analysis

max time kernel
24s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10e4285e214e0818d6102413d37b3bbd.exe
Size

187KB
MD5

10e4285e214e0818d6102413d37b3bbd
SHA1

24d55c99c4b8e59570f1efef9380abbfb09edbde
SHA256

3d0c6513970d62e3b375101b3d0ad48f30ef17488bf2f0de8b3a1a100ab52eb1
SHA512

f7c8d26bb67fd2d99e5cc72e004716939889aa803b2cb377fd57b59179fb85dabd26a94a1aa032abde7cc08ff7adc245bd77bef43ceec26d751ecda89376be28
SSDEEP

3072:DELCemonYyTvbDpl/evpLeWpFgl47Rc78pT0bHjUftffU:g5monDj/UC4+l4707jWC

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2784	B6232F3AE5F.exe
4248	KOQ4BDE.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4Y3Y0C3AYF7W0E6DFBZTG = "C:\\Recycle.Bin\\B6232F3AE5F.exe"	KOQ4BDE.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\PhishingFilter	KOQ4BDE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	KOQ4BDE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0"	KOQ4BDE.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery	KOQ4BDE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0"	KOQ4BDE.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
668	10e4285e214e0818d6102413d37b3bbd.exe
668	10e4285e214e0818d6102413d37b3bbd.exe
668	10e4285e214e0818d6102413d37b3bbd.exe
668	10e4285e214e0818d6102413d37b3bbd.exe
2784	B6232F3AE5F.exe
2784	B6232F3AE5F.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe
4248	KOQ4BDE.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	10e4285e214e0818d6102413d37b3bbd.exe
Token: SeDebugPrivilege	668	10e4285e214e0818d6102413d37b3bbd.exe
Token: SeDebugPrivilege	668	10e4285e214e0818d6102413d37b3bbd.exe
Token: SeDebugPrivilege	668	10e4285e214e0818d6102413d37b3bbd.exe
Token: SeDebugPrivilege	2784	B6232F3AE5F.exe
Token: SeDebugPrivilege	2784	B6232F3AE5F.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe
Token: SeDebugPrivilege	4248	KOQ4BDE.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2784	668	10e4285e214e0818d6102413d37b3bbd.exe	42
PID 668 wrote to memory of 2784	668	10e4285e214e0818d6102413d37b3bbd.exe	42
PID 668 wrote to memory of 2784	668	10e4285e214e0818d6102413d37b3bbd.exe	42
PID 2784 wrote to memory of 4248	2784	B6232F3AE5F.exe	53
PID 2784 wrote to memory of 4248	2784	B6232F3AE5F.exe	53
PID 2784 wrote to memory of 4248	2784	B6232F3AE5F.exe	53
PID 2784 wrote to memory of 4248	2784	B6232F3AE5F.exe	53
PID 2784 wrote to memory of 4248	2784	B6232F3AE5F.exe	53
PID 4248 wrote to memory of 668	4248	KOQ4BDE.exe	14
PID 4248 wrote to memory of 668	4248	KOQ4BDE.exe	14
PID 4248 wrote to memory of 668	4248	KOQ4BDE.exe	14
PID 4248 wrote to memory of 668	4248	KOQ4BDE.exe	14

C:\Users\Admin\AppData\Local\Temp\10e4285e214e0818d6102413d37b3bbd.exe
"C:\Users\Admin\AppData\Local\Temp\10e4285e214e0818d6102413d37b3bbd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668
- C:\Recycle.Bin\B6232F3AE5F.exe
  "C:\Recycle.Bin\B6232F3AE5F.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\KOQ4BDE.exe
    "C:\Users\Admin\AppData\Local\Temp\KOQ4BDE.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-125-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/668-123-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/668-7-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/668-6-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/668-5-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/668-3-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/668-2-0x0000000002550000-0x00000000025E0000-memory.dmp

Filesize
576KB

Download
memory/668-95-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-8-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/668-14-0x0000000000BC0000-0x0000000000BC2000-memory.dmp

Filesize
8KB

Download
memory/668-13-0x0000000077682000-0x0000000077684000-memory.dmp

Filesize
8KB

Download
memory/668-9-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/668-0-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/668-98-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-87-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-127-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/668-102-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-76-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-64-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/668-73-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-70-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-115-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-79-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-4-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/668-108-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-1-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/668-96-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-54-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/668-104-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-59-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/668-106-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-112-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-113-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-69-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-120-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/668-124-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-117-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/668-122-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Filesize
4KB

Download
memory/668-118-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/2784-33-0x0000000002690000-0x0000000002790000-memory.dmp

Filesize
1024KB

Download
memory/2784-29-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/2784-24-0x0000000002550000-0x0000000002640000-memory.dmp

Filesize
960KB

Download
memory/2784-23-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/2784-22-0x0000000002550000-0x0000000002640000-memory.dmp

Filesize
960KB

Download
memory/2784-21-0x0000000002550000-0x0000000002640000-memory.dmp

Filesize
960KB

Download
memory/2784-20-0x0000000002460000-0x00000000024F0000-memory.dmp

Filesize
576KB

Download
memory/2784-19-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2784-31-0x0000000002690000-0x0000000002790000-memory.dmp

Filesize
1024KB

Download
memory/2784-25-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2784-18-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2784-37-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4248-90-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-51-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-92-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-86-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-99-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-83-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-82-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-103-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-77-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-75-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-110-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-74-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-114-0x0000000077280000-0x00000000772E3000-memory.dmp

Filesize
396KB

Download
memory/4248-71-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-72-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-116-0x00000000031E0000-0x0000000003243000-memory.dmp

Filesize
396KB

Download
memory/4248-68-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-63-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-62-0x0000000077682000-0x0000000077684000-memory.dmp

Filesize
8KB

Download
memory/4248-61-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-60-0x0000000077684000-0x0000000077686000-memory.dmp

Filesize
8KB

Download
memory/4248-105-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-57-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-55-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-101-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-53-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-52-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-97-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-49-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-43-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-40-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-39-0x0000000001000000-0x0000000001004000-memory.dmp

Filesize
16KB

Download
memory/4248-38-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-94-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-88-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-32-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-78-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-66-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-58-0x0000000077682000-0x0000000077684000-memory.dmp

Filesize
8KB

Download
memory/4248-56-0x0000000077682000-0x0000000077684000-memory.dmp

Filesize
8KB

Download
memory/4248-47-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4248-44-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-41-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-130-0x0000000000910000-0x000000000095E000-memory.dmp

Filesize
312KB

Download
memory/4248-131-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4248-133-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-134-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-132-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-135-0x0000000000ED0000-0x0000000000F33000-memory.dmp

Filesize
396KB

Download
memory/4248-137-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-138-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

Filesize
312KB

Download
memory/4248-139-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-141-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-143-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-142-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-140-0x0000000002900000-0x0000000002D50000-memory.dmp

Filesize
4.3MB

Download
memory/4248-148-0x0000000074FE0000-0x0000000075430000-memory.dmp

Filesize
4.3MB

Download
memory/4248-149-0x0000000000ED0000-0x0000000000F33000-memory.dmp

Filesize
396KB

Download