Analysis
-
max time kernel
45s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 19:35
Static task
static1
Behavioral task
behavioral1
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win10v2004-20231215-en
General
-
Target
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
-
Size
104KB
-
MD5
a3ff56835b4bd0e80f6e95fbfc741a8e
-
SHA1
8af2b8e66107890df87a3c6ee9a5712228f95d8a
-
SHA256
ee9fd41093ef9d4e21a78ab987df6ad42a6fa5dcea7ebd9c5ff1e1f388720d8e
-
SHA512
1dbc80bccb87b4f1330a783fb4c2c7840cec6d9c280c261c8df2d8bdd4188ca1e779665f00cb35440660f70e95a06f178387aa113803ef0581dd2d658694107b
-
SSDEEP
1536:+eS3Yzxx6ZTD9Um9UoCONGAho+nuzGHRbVV3jEbgkxpPNOf5uze3S:+eS3Yzxx6R63ahJn9RStUYzeC
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ZbECSrTmBt = "C:\\Users\\Admin\\AppData\\Roaming\\LzYAJeGoJn\\jHHCSpKiYF.exe" a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 4696 set thread context of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exepid process 3488 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process Token: SeDebugPrivilege 3488 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3488 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3488 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 4696 wrote to memory of 3488 4696 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3488-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3488-17-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/3488-16-0x0000000006360000-0x0000000006378000-memory.dmpFilesize
96KB
-
memory/3488-15-0x0000000005370000-0x00000000053D6000-memory.dmpFilesize
408KB
-
memory/3488-14-0x00000000050E0000-0x00000000050EA000-memory.dmpFilesize
40KB
-
memory/3488-11-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/3488-13-0x0000000004D70000-0x0000000004D80000-memory.dmpFilesize
64KB
-
memory/4696-3-0x0000000005A70000-0x0000000006014000-memory.dmpFilesize
5.6MB
-
memory/4696-12-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/4696-7-0x0000000005400000-0x000000000540A000-memory.dmpFilesize
40KB
-
memory/4696-5-0x0000000005560000-0x00000000055FC000-memory.dmpFilesize
624KB
-
memory/4696-4-0x00000000054C0000-0x0000000005552000-memory.dmpFilesize
584KB
-
memory/4696-0-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/4696-2-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/4696-1-0x0000000000A30000-0x0000000000A50000-memory.dmpFilesize
128KB