Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 04:15
Behavioral task
behavioral1
Sample
4a69a5aaec05604e43612f025a3137dc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a69a5aaec05604e43612f025a3137dc.exe
Resource
win10v2004-20231215-en
General
-
Target
4a69a5aaec05604e43612f025a3137dc.exe
-
Size
218KB
-
MD5
4a69a5aaec05604e43612f025a3137dc
-
SHA1
2a42aaf1ec649d882f8faa7018b0a996616d11ca
-
SHA256
5a39b90268e60068ab104fca228b90ae9ca8b13a3778cbf86c2aa1131d83b66e
-
SHA512
d457ecb47105820c09aefd8a7229a1ba9944cbc46b6af1c95f89ef6e1c929a1c2a459dbae31d03b19cd171eb208b6e1ea291702a024c0aebcd030b1d3bf5c93f
-
SSDEEP
3072:ZqBRz55UAYxUsa/7EUp84NHNtGdVKS3l:ZqBn5UAYxebcX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2608 sesnaestzupa.exe 2632 sesnaestzupa.exe -
Loads dropped DLL 8 IoCs
pid Process 2548 4a69a5aaec05604e43612f025a3137dc.exe 2608 sesnaestzupa.exe 2608 sesnaestzupa.exe 2608 sesnaestzupa.exe 2608 sesnaestzupa.exe 2632 sesnaestzupa.exe 2632 sesnaestzupa.exe 2632 sesnaestzupa.exe -
resource yara_rule behavioral1/memory/2996-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2996-7-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2548-11-0x0000000000230000-0x0000000000268000-memory.dmp upx behavioral1/files/0x000b00000000e610-15.dat upx behavioral1/memory/2548-17-0x0000000000270000-0x00000000002A8000-memory.dmp upx behavioral1/memory/2608-33-0x0000000000400000-0x0000000000438000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v8.0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaestzupa.exe" 4a69a5aaec05604e43612f025a3137dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v8.0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaestzupa.exe" 4a69a5aaec05604e43612f025a3137dc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2996 set thread context of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2608 set thread context of 2632 2608 sesnaestzupa.exe 32 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2996 4a69a5aaec05604e43612f025a3137dc.exe 2608 sesnaestzupa.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2996 wrote to memory of 2548 2996 4a69a5aaec05604e43612f025a3137dc.exe 28 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2548 wrote to memory of 2608 2548 4a69a5aaec05604e43612f025a3137dc.exe 29 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32 PID 2608 wrote to memory of 2632 2608 sesnaestzupa.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD54a69a5aaec05604e43612f025a3137dc
SHA12a42aaf1ec649d882f8faa7018b0a996616d11ca
SHA2565a39b90268e60068ab104fca228b90ae9ca8b13a3778cbf86c2aa1131d83b66e
SHA512d457ecb47105820c09aefd8a7229a1ba9944cbc46b6af1c95f89ef6e1c929a1c2a459dbae31d03b19cd171eb208b6e1ea291702a024c0aebcd030b1d3bf5c93f