444ec39e947b018f2db462737c26c32aa4f8badcd99c206a11f652f43de42048

Analysis

max time kernel
0s
max time network
2s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b063c2241097d8b61458c3587b1f980.exe
Size

18KB
MD5

2b063c2241097d8b61458c3587b1f980
SHA1

79069663453be3ca3643260f9505cbb14c742913
SHA256

444ec39e947b018f2db462737c26c32aa4f8badcd99c206a11f652f43de42048
SHA512

a83ce67196d8f7f6c7452ae479c4f299f349a304846e1a19b53caebb022b2f91fce6f41bead506f54644a34bb8851378f9b24cf2e6433ada9ea9fff69d13a8e6
SSDEEP

384:1QQ5AWnSDsJkS5a9zSiQlDKdfS44hNbM1AeCc17tQfXGa7qu+:2KnSDgr5MmiQlDKdYng+/hqP

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1104	2b063c2241097d8b61458c3587b1f980.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\dbhlp32 = "C:\\Windows\\dbhlp32.exe"	2b063c2241097d8b61458c3587b1f980.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dbhlp32.dlL	2b063c2241097d8b61458c3587b1f980.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\dbhlp32.exe	2b063c2241097d8b61458c3587b1f980.exe
File opened for modification	C:\Windows\dbhlp32.exe	2b063c2241097d8b61458c3587b1f980.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1104	2b063c2241097d8b61458c3587b1f980.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	2b063c2241097d8b61458c3587b1f980.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1368	1104	2b063c2241097d8b61458c3587b1f980.exe	7
PID 1104 wrote to memory of 1368	1104	2b063c2241097d8b61458c3587b1f980.exe	7

C:\Users\Admin\AppData\Local\Temp\2b063c2241097d8b61458c3587b1f980.exe
"C:\Users\Admin\AppData\Local\Temp\2b063c2241097d8b61458c3587b1f980.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\dbhlp32.dlL

Filesize
28KB

MD5
107644a5982a9b513854c95ed28525ad

SHA1
54f38105c1833cf55d95debedb50d9ab40094b5d

SHA256
e936ef0934153ebe7f509938bd81ad1be6fe02708ea9343754f553179d250d43

SHA512
b5e2672b1ce402ccf616c9c27d49de1cfba99c16be100543ab00e54362586e0fe6b1c4f4fa9f559e43a815f41e7d1b855c91c4e254b0fd6cc8f63f52cb44cac0

Download Submit
memory/1104-10-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1368-2-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download