Analysis
-
max time kernel
129s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
3233ddeb354b7513eb814477bef54fca.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3233ddeb354b7513eb814477bef54fca.exe
Resource
win10v2004-20231222-en
General
-
Target
3233ddeb354b7513eb814477bef54fca.exe
-
Size
912KB
-
MD5
3233ddeb354b7513eb814477bef54fca
-
SHA1
f7234caf62f99b42fca21b6011fbffa0475e52f8
-
SHA256
a70a36bd91ec5789913fee8983da5e5edfbf1b5854609fa9fb0d80a30fab3fde
-
SHA512
bccb1cc202fa8940c9b90becd435753c806a97199173e14bc538fa442dd505bfe5d364dd69418a69da6fae73e4b02342e74049864e251e6cd24d87edce446200
-
SSDEEP
24576:SVJuEskQC0HAqIYG3GNjAFjppJ8XLQlB5AjkKJC/ClNk5fpdbs:KFQCV4G3pFrJ8XEtAjkQaIwLo
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\wmbrjj.dll" aasd.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\wmbrjj.dll" aasd.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\wmbrjj.dll" aasd.exe -
Executes dropped EXE 2 IoCs
pid Process 1608 aasd.exe 2696 yong.exe -
Loads dropped DLL 2 IoCs
pid Process 1608 aasd.exe 2764 svchost.exe -
resource yara_rule behavioral1/memory/1608-28-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect behavioral1/memory/2764-35-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect behavioral1/memory/2764-34-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect behavioral1/memory/1608-29-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect behavioral1/memory/2764-43-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"F:\\msdownld.tmp\\IXP000.TMP\\\"" 3233ddeb354b7513eb814477bef54fca.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 3233ddeb354b7513eb814477bef54fca.exe File opened (read-only) \??\B: 3233ddeb354b7513eb814477bef54fca.exe File opened (read-only) \??\E: 3233ddeb354b7513eb814477bef54fca.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\0005ccee.sys aasd.exe File created C:\Windows\SysWOW64\wmbrjj.dll aasd.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1608 aasd.exe 2696 yong.exe 2696 yong.exe 2764 svchost.exe 2764 svchost.exe 2764 svchost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 1608 1568 3233ddeb354b7513eb814477bef54fca.exe 19 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18 PID 1568 wrote to memory of 2696 1568 3233ddeb354b7513eb814477bef54fca.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\3233ddeb354b7513eb814477bef54fca.exe"C:\Users\Admin\AppData\Local\Temp\3233ddeb354b7513eb814477bef54fca.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1568 -
F:\msdownld.tmp\IXP000.TMP\yong.exeF:\msdownld.tmp\IXP000.TMP\yong.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
F:\msdownld.tmp\IXP000.TMP\aasd.exeF:\msdownld.tmp\IXP000.TMP\aasd.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k marchi1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2764