Analysis
-
max time kernel
91s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 15:51
Behavioral task
behavioral1
Sample
3a6751a147c296933b78c42779a92e6d.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a6751a147c296933b78c42779a92e6d.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3a6751a147c296933b78c42779a92e6d.exe
-
Size
57KB
-
MD5
3a6751a147c296933b78c42779a92e6d
-
SHA1
f01e0830e48f6cf29f08970fdb7f33198fd7bd3e
-
SHA256
da006d6d696d6b5ef17f6e488ad101135d6877036f0e9b2cd59fbcc64b99730e
-
SHA512
cc6cc792142895750fa7791622dd4acc11fe9573d6fa7116e648572b93b8574b7b59f419583314ef35157d151ff8108fe685d2b613a7c0c93056162f6faa1705
-
SSDEEP
1536:f0KYsV5EyK3ud6uSMkpJxbTbAjYxNygeBeILL/z239nouy8+FGiaK:HV5Eywuwu1ax2RgPILzAoutM
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
3a6751a147c296933b78c42779a92e6d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\22CC6C32.exe" 3a6751a147c296933b78c42779a92e6d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\22CC6C32.exe" 3a6751a147c296933b78c42779a92e6d.exe -
Processes:
resource yara_rule behavioral2/memory/228-0-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral2/memory/3716-8-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3716-13-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3716-9-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3716-7-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3716-6-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/228-5-0x0000000000400000-0x0000000000480000-memory.dmp upx behavioral2/memory/3716-3-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3716-14-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3a6751a147c296933b78c42779a92e6d.exedescription pid process target process PID 228 set thread context of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a6751a147c296933b78c42779a92e6d.exepid process 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe 3716 3a6751a147c296933b78c42779a92e6d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3a6751a147c296933b78c42779a92e6d.exepid process 228 3a6751a147c296933b78c42779a92e6d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3a6751a147c296933b78c42779a92e6d.exedescription pid process target process PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe PID 228 wrote to memory of 3716 228 3a6751a147c296933b78c42779a92e6d.exe 3a6751a147c296933b78c42779a92e6d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6751a147c296933b78c42779a92e6d.exe"C:\Users\Admin\AppData\Local\Temp\3a6751a147c296933b78c42779a92e6d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3a6751a147c296933b78c42779a92e6d.exeC:\Users\Admin\AppData\Local\Temp\3a6751a147c296933b78c42779a92e6d.exe2⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/228-0-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/228-5-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3716-8-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-13-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-6-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3716-14-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB