Analysis
-
max time kernel
167s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
3ef813d3b06de0d718960ee0b3cac240.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3ef813d3b06de0d718960ee0b3cac240.exe
Resource
win10v2004-20231215-en
General
-
Target
3ef813d3b06de0d718960ee0b3cac240.exe
-
Size
107KB
-
MD5
3ef813d3b06de0d718960ee0b3cac240
-
SHA1
0358d69e1bb21aba314832be52aed676511d7224
-
SHA256
04758db8553c2e207871021008fdba4a99576d3dfc9a1a42bbdfddf2448e333d
-
SHA512
293d0af7a8dea9e7d32aea0a9f235c8d1eb500983c50eb392ca6bc5f1b1327118aee2eae924ba3ab0676d706ecdf49d6d6763f12879f68fc6cd4d005950652a0
-
SSDEEP
1536:3WU7JfGXyjPrwpw2ZCZg6oIg/g4Rx/jz6OLVSRepPk7IfsdOApw/8Wt0qfplybjO:H1xUpgZ2J/g4n/FsRecP5pI8WRpyK
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 804 3ef813d3b06de0d718960ee0b3cac240.exe 804 3ef813d3b06de0d718960ee0b3cac240.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\B831406A9770.dll 3ef813d3b06de0d718960ee0b3cac240.exe File opened for modification C:\Windows\Debug\B831406A9770.dll 3ef813d3b06de0d718960ee0b3cac240.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{291FABA8-CB00-488C-AC9E-B457FFC4A117}\InProcServer32\ThrEaDiNgModEL = "aPaRTmEnT" 3ef813d3b06de0d718960ee0b3cac240.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{291FABA8-CB00-488C-AC9E-B457FFC4A117} 3ef813d3b06de0d718960ee0b3cac240.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{291FABA8-CB00-488C-AC9E-B457FFC4A117}\ = "fsvdf" 3ef813d3b06de0d718960ee0b3cac240.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{291FABA8-CB00-488C-AC9E-B457FFC4A117}\InProcServer32 3ef813d3b06de0d718960ee0b3cac240.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{291FABA8-CB00-488C-AC9E-B457FFC4A117}\InProcServer32\ = "C:\\Windows\\Debug\\B831406A9770.dll" 3ef813d3b06de0d718960ee0b3cac240.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 804 3ef813d3b06de0d718960ee0b3cac240.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 804 wrote to memory of 4632 804 3ef813d3b06de0d718960ee0b3cac240.exe 93 PID 804 wrote to memory of 4632 804 3ef813d3b06de0d718960ee0b3cac240.exe 93 PID 804 wrote to memory of 4632 804 3ef813d3b06de0d718960ee0b3cac240.exe 93 PID 804 wrote to memory of 4168 804 3ef813d3b06de0d718960ee0b3cac240.exe 99 PID 804 wrote to memory of 4168 804 3ef813d3b06de0d718960ee0b3cac240.exe 99 PID 804 wrote to memory of 4168 804 3ef813d3b06de0d718960ee0b3cac240.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ef813d3b06de0d718960ee0b3cac240.exe"C:\Users\Admin\AppData\Local\Temp\3ef813d3b06de0d718960ee0b3cac240.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat2⤵PID:4632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2.bat2⤵PID:4168
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41B
MD5ba7fbc1af9676442d6da5bdb5afe813c
SHA1151f5f221a3e02f9e51a8cb20495416b79da4c04
SHA256ffac204151edc4de9316c4416df635cd0d68a1d4b33125e6bf32209b0f879816
SHA51294338b36552b9b5f9772b735ebfb8dce8d750ce3c81996f2cd052d0f1e0d9010366d6b711340356506f81d4cd875c8cb0ee71ab0d5c77e22ab9d98893cc70edd
-
Filesize
52B
MD579f485589be6c5807d897f83641c45f5
SHA1cf89f8962cbb25c0a22949e6956b2f7340680f59
SHA2567ac89c9449bb50e781081d1bee95b39f786553f79ae651638097748f926ff2ec
SHA512409cf520741545b8674b9a2164741a0a1b00057162ee084f02e0752880995df7494ba1cbc8fedb30cae21c42b8d16cb28d9063d915732c967fdacae12b732278
-
Filesize
154KB
MD576a1b33a8596a8817e47bf61727adfa2
SHA1bae46d76c9a70f44bdaa19f8a3bc8dfd477428c6
SHA25636576ad5de7e2361d874173baad78ecf7a0158a8ecd17a57028958590e8cfacf
SHA51264764a1346c79030165731c4b30bdb603e1c11f026576b98256f916d1113f60d40628864eaece5ee6f5bec6359d928a61c566ab99de0957fe77445966bb890b4