Analysis
-
max time kernel
162s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 13:44
Static task
static1
Behavioral task
behavioral1
Sample
1a6df3c735fdc4b767ff4e19c19d10a4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1a6df3c735fdc4b767ff4e19c19d10a4.exe
Resource
win10v2004-20231215-en
General
-
Target
1a6df3c735fdc4b767ff4e19c19d10a4.exe
-
Size
269KB
-
MD5
1a6df3c735fdc4b767ff4e19c19d10a4
-
SHA1
583f01d2222d24d7e681c957c2cd27b21ab334bf
-
SHA256
c21f799128f8fe7624ec85d14f87bdeacbd2f8a90c5fd71c4a45dec338d36704
-
SHA512
2c7216381b687532befe6ac3b22dcc7e0a5594d0c1335e933405c80b13dbf20048f3574c215433a3d0262f9073bdfbff8ce694d51a6998fea418d9f4cbd40d82
-
SSDEEP
6144:EvhSU1TVgzhGP6k//BVaLJl/5dv/s1ItyPwKKt/:AQU1TVM4P60/BVatB5dv/sTPwx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 4064 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogs = "C:\\Users\\Admin\\AppData\\Roaming\\winloger.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a6df3c735fdc4b767ff4e19c19d10a4.exedescription pid process target process PID 2420 set thread context of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1a6df3c735fdc4b767ff4e19c19d10a4.exedescription pid process Token: SeDebugPrivilege 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
1a6df3c735fdc4b767ff4e19c19d10a4.exedescription pid process target process PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe PID 2420 wrote to memory of 4064 2420 1a6df3c735fdc4b767ff4e19c19d10a4.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a6df3c735fdc4b767ff4e19c19d10a4.exe"C:\Users\Admin\AppData\Local\Temp\1a6df3c735fdc4b767ff4e19c19d10a4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
memory/2420-0-0x0000000074D30000-0x00000000752E1000-memory.dmpFilesize
5.7MB
-
memory/2420-2-0x0000000000F20000-0x0000000000F30000-memory.dmpFilesize
64KB
-
memory/2420-1-0x0000000074D30000-0x00000000752E1000-memory.dmpFilesize
5.7MB
-
memory/2420-10-0x0000000074D30000-0x00000000752E1000-memory.dmpFilesize
5.7MB
-
memory/4064-5-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4064-11-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4064-9-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4064-14-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4064-12-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB