Analysis
-
max time kernel
147s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 10:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3233ddeb354b7513eb814477bef54fca.exe
Resource
win7-20231215-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3233ddeb354b7513eb814477bef54fca.exe
Resource
win10v2004-20231222-en
8 signatures
150 seconds
General
-
Target
3233ddeb354b7513eb814477bef54fca.exe
-
Size
912KB
-
MD5
3233ddeb354b7513eb814477bef54fca
-
SHA1
f7234caf62f99b42fca21b6011fbffa0475e52f8
-
SHA256
a70a36bd91ec5789913fee8983da5e5edfbf1b5854609fa9fb0d80a30fab3fde
-
SHA512
bccb1cc202fa8940c9b90becd435753c806a97199173e14bc538fa442dd505bfe5d364dd69418a69da6fae73e4b02342e74049864e251e6cd24d87edce446200
-
SSDEEP
24576:SVJuEskQC0HAqIYG3GNjAFjppJ8XLQlB5AjkKJC/ClNk5fpdbs:KFQCV4G3pFrJ8XEtAjkQaIwLo
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\mmzokc.dll" aasd.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\mmzokc.dll" aasd.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\marchi\Parameters\ServiceDll = "%SystemRoot%\\System32\\mmzokc.dll" aasd.exe -
Executes dropped EXE 2 IoCs
pid Process 4460 aasd.exe 2212 yong.exe -
Loads dropped DLL 2 IoCs
pid Process 4460 aasd.exe 852 svchost.exe -
resource yara_rule behavioral2/memory/4460-22-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect behavioral2/memory/4460-25-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect behavioral2/memory/4460-24-0x0000000010000000-0x00000000100B6000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3233ddeb354b7513eb814477bef54fca.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\0005ccee.sys aasd.exe File created C:\Windows\SysWOW64\mmzokc.dll aasd.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4460 aasd.exe 2212 yong.exe 2212 yong.exe 852 svchost.exe 852 svchost.exe 852 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4644 wrote to memory of 4460 4644 3233ddeb354b7513eb814477bef54fca.exe 35 PID 4644 wrote to memory of 4460 4644 3233ddeb354b7513eb814477bef54fca.exe 35 PID 4644 wrote to memory of 4460 4644 3233ddeb354b7513eb814477bef54fca.exe 35 PID 4644 wrote to memory of 2212 4644 3233ddeb354b7513eb814477bef54fca.exe 31 PID 4644 wrote to memory of 2212 4644 3233ddeb354b7513eb814477bef54fca.exe 31 PID 4644 wrote to memory of 2212 4644 3233ddeb354b7513eb814477bef54fca.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3233ddeb354b7513eb814477bef54fca.exe"C:\Users\Admin\AppData\Local\Temp\3233ddeb354b7513eb814477bef54fca.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yong.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yong.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aasd.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\aasd.exe2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4460
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k marchi1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:852