Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 04:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3bdb5bee0539aa49ab489385c4f24591.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3bdb5bee0539aa49ab489385c4f24591.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
3bdb5bee0539aa49ab489385c4f24591.exe
-
Size
361KB
-
MD5
3bdb5bee0539aa49ab489385c4f24591
-
SHA1
d254e13bb1d647841c46ef23bdea512eb17fe56c
-
SHA256
1ff5e122fbfd7b0f3fec81adcd596c41f88a79525ef30d4842cf7076c5eb8d4d
-
SHA512
679d0f32d14d5edf76d70f9a1b685e099808a1cafc186ae9b7fd056fca01b757aa2aa9ed2ee1373075314f33120e5f7e3669718a9e514c34a0674ce1c24f6631
-
SSDEEP
6144:0YnUIr+OXOBaU7iGYiJkaV2OFbC4XEqPTY/U1GvbYG+XtLETkzmo:0YnUZxgU7iGYiJkaC2fPTY/U8vbYj54O
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\ProgramData\\gD02401OpKnF02401\\gD02401OpKnF02401.exe" 3bdb5bee0539aa49ab489385c4f24591.exe -
Executes dropped EXE 1 IoCs
pid Process 2236 gD02401OpKnF02401.exe -
Loads dropped DLL 2 IoCs
pid Process 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe -
resource yara_rule behavioral1/memory/2284-0-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2284-2-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2284-4-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2284-13-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2284-33-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2236-38-0x0000000000400000-0x00000000004CC000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe 2284 3bdb5bee0539aa49ab489385c4f24591.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2284 3bdb5bee0539aa49ab489385c4f24591.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2236 2284 3bdb5bee0539aa49ab489385c4f24591.exe 32 PID 2284 wrote to memory of 2236 2284 3bdb5bee0539aa49ab489385c4f24591.exe 32 PID 2284 wrote to memory of 2236 2284 3bdb5bee0539aa49ab489385c4f24591.exe 32 PID 2284 wrote to memory of 2236 2284 3bdb5bee0539aa49ab489385c4f24591.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bdb5bee0539aa49ab489385c4f24591.exe"C:\Users\Admin\AppData\Local\Temp\3bdb5bee0539aa49ab489385c4f24591.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\ProgramData\gD02401OpKnF02401\gD02401OpKnF02401.exe"C:\ProgramData\gD02401OpKnF02401\gD02401OpKnF02401.exe" "C:\Users\Admin\AppData\Local\Temp\3bdb5bee0539aa49ab489385c4f24591.exe"2⤵
- Executes dropped EXE
PID:2236
-