Analysis

  • max time kernel
    183s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06-01-2024 21:26

General

  • Target

    4736226d9a237c905fad4c5c89eb61d1.exe

  • Size

    262KB

  • MD5

    4736226d9a237c905fad4c5c89eb61d1

  • SHA1

    b1e6731b1ced0ab43e986460c478d4c9d9497bef

  • SHA256

    a92ad73c5b612720d3561622c6e11f18613d0ea39234870d6f6879e45d358f92

  • SHA512

    17efec0e254e4a4a4fb7941bc5c935b6c3227f787e5a58cf86dda4cac538bfef459aee509fc8fe1d44c7890c79a96c8b0f027ccdd98980e8d3ad28818b200a86

  • SSDEEP

    6144:Hv8Gp+df0afmVTRMdNdpn94sLrNXel9jb98+MATD:P8YkfXf4TRMj94svNuzjb9ZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1188
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1260
        • C:\Users\Admin\AppData\Local\Temp\4736226d9a237c905fad4c5c89eb61d1.exe
          "C:\Users\Admin\AppData\Local\Temp\4736226d9a237c905fad4c5c89eb61d1.exe"
          2⤵
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Users\Admin\AppData\Roaming\Ytka\feuda.exe
            "C:\Users\Admin\AppData\Roaming\Ytka\feuda.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:2736
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd1f810ad.bat"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 116
              4⤵
              • Program crash
              PID:2356
      • C:\Windows\system32\taskhost.exe
        "taskhost.exe"
        1⤵
          PID:1120
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-400656756-1558211121-64129222-12080864211975896732-1133015696444122183-1892289517"
          1⤵
            PID:1620

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Jefega\ymehu.xan

            Filesize

            366B

            MD5

            de03d8538369f7e4c10fc90c674fc726

            SHA1

            96dd422474473e29db15acbc4a19e124e4452b05

            SHA256

            54007e5f4c5c189a81e6dfc2cb57b6c61a7827b69ab3531a4801d204a7369789

            SHA512

            c1537baf09ed9b55652c71d2790e40ba3aaa17698e3b2a00c77af9d355eff72fc0e7adda99fc57a81e9a064fc7b49f1ce298a0584686eddc4694ebea57b3d0a6

          • \Users\Admin\AppData\Roaming\Ytka\feuda.exe

            Filesize

            262KB

            MD5

            741de4a43c8763b63ff3b529d2caab3d

            SHA1

            1caf06dc61a09fbbca189606c7fd80de513bafe3

            SHA256

            3d1882909439a14f0f08cde308a13969121f73867293c17346d55754ffcc1b2f

            SHA512

            90c29b090508e7d4063ef0f7acf6337d162ec024dd96f02cde976de8a55b974542c9bd962dd00810dfbc3a2d8d2484ef8fcdf13c9c18d6b0f875dfc143e09295

          • memory/1120-18-0x0000000001F90000-0x0000000001FD1000-memory.dmp

            Filesize

            260KB

          • memory/1120-17-0x0000000001F90000-0x0000000001FD1000-memory.dmp

            Filesize

            260KB

          • memory/1120-20-0x0000000001F90000-0x0000000001FD1000-memory.dmp

            Filesize

            260KB

          • memory/1120-19-0x0000000001F90000-0x0000000001FD1000-memory.dmp

            Filesize

            260KB

          • memory/1120-16-0x0000000001F90000-0x0000000001FD1000-memory.dmp

            Filesize

            260KB

          • memory/1188-25-0x0000000001BA0000-0x0000000001BE1000-memory.dmp

            Filesize

            260KB

          • memory/1188-24-0x0000000001BA0000-0x0000000001BE1000-memory.dmp

            Filesize

            260KB

          • memory/1188-22-0x0000000001BA0000-0x0000000001BE1000-memory.dmp

            Filesize

            260KB

          • memory/1188-23-0x0000000001BA0000-0x0000000001BE1000-memory.dmp

            Filesize

            260KB

          • memory/1260-29-0x0000000002B70000-0x0000000002BB1000-memory.dmp

            Filesize

            260KB

          • memory/1260-30-0x0000000002B70000-0x0000000002BB1000-memory.dmp

            Filesize

            260KB

          • memory/1260-28-0x0000000002B70000-0x0000000002BB1000-memory.dmp

            Filesize

            260KB

          • memory/1260-27-0x0000000002B70000-0x0000000002BB1000-memory.dmp

            Filesize

            260KB

          • memory/2356-266-0x00000000004E0000-0x00000000004E1000-memory.dmp

            Filesize

            4KB

          • memory/2356-270-0x00000000025A0000-0x00000000025E1000-memory.dmp

            Filesize

            260KB

          • memory/2356-265-0x0000000077620000-0x0000000077621000-memory.dmp

            Filesize

            4KB

          • memory/2356-171-0x00000000025A0000-0x00000000025E1000-memory.dmp

            Filesize

            260KB

          • memory/2736-14-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2736-12-0x0000000000280000-0x00000000002C1000-memory.dmp

            Filesize

            260KB

          • memory/2736-152-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2736-13-0x0000000000350000-0x0000000000395000-memory.dmp

            Filesize

            276KB

          • memory/2892-38-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-37-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-66-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-64-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-62-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-60-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-58-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-56-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-54-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-52-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-50-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-149-0x0000000000380000-0x00000000003C5000-memory.dmp

            Filesize

            276KB

          • memory/2892-150-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2892-151-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-48-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-46-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-44-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-42-0x0000000077620000-0x0000000077621000-memory.dmp

            Filesize

            4KB

          • memory/2892-41-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-68-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-34-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-32-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-70-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-132-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-74-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-76-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-78-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-80-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-72-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2892-40-0x0000000077620000-0x0000000077621000-memory.dmp

            Filesize

            4KB

          • memory/2892-0-0x0000000000330000-0x0000000000371000-memory.dmp

            Filesize

            260KB

          • memory/2892-36-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-35-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-33-0x00000000004E0000-0x0000000000521000-memory.dmp

            Filesize

            260KB

          • memory/2892-5-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2892-3-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2892-4-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2892-2-0x0000000000400000-0x0000000000441000-memory.dmp

            Filesize

            260KB

          • memory/2892-1-0x0000000000380000-0x00000000003C5000-memory.dmp

            Filesize

            276KB