Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 04:15
Behavioral task
behavioral1
Sample
4a69a5aaec05604e43612f025a3137dc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a69a5aaec05604e43612f025a3137dc.exe
Resource
win10v2004-20231215-en
General
-
Target
4a69a5aaec05604e43612f025a3137dc.exe
-
Size
218KB
-
MD5
4a69a5aaec05604e43612f025a3137dc
-
SHA1
2a42aaf1ec649d882f8faa7018b0a996616d11ca
-
SHA256
5a39b90268e60068ab104fca228b90ae9ca8b13a3778cbf86c2aa1131d83b66e
-
SHA512
d457ecb47105820c09aefd8a7229a1ba9944cbc46b6af1c95f89ef6e1c929a1c2a459dbae31d03b19cd171eb208b6e1ea291702a024c0aebcd030b1d3bf5c93f
-
SSDEEP
3072:ZqBRz55UAYxUsa/7EUp84NHNtGdVKS3l:ZqBn5UAYxebcX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3848 sesnaestzupa.exe 528 sesnaestzupa.exe -
resource yara_rule behavioral2/memory/5052-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/5052-5-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002321b-11.dat upx behavioral2/memory/3848-21-0x0000000000400000-0x0000000000438000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v8.0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaestzupa.exe" 4a69a5aaec05604e43612f025a3137dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver Control Manager v8.0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sesnaestzupa.exe" 4a69a5aaec05604e43612f025a3137dc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5052 set thread context of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 3848 set thread context of 528 3848 sesnaestzupa.exe 101 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5052 4a69a5aaec05604e43612f025a3137dc.exe 3848 sesnaestzupa.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 5052 wrote to memory of 1668 5052 4a69a5aaec05604e43612f025a3137dc.exe 93 PID 1668 wrote to memory of 3848 1668 4a69a5aaec05604e43612f025a3137dc.exe 95 PID 1668 wrote to memory of 3848 1668 4a69a5aaec05604e43612f025a3137dc.exe 95 PID 1668 wrote to memory of 3848 1668 4a69a5aaec05604e43612f025a3137dc.exe 95 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101 PID 3848 wrote to memory of 528 3848 sesnaestzupa.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"C:\Users\Admin\AppData\Local\Temp\4a69a5aaec05604e43612f025a3137dc.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"C:\Users\Admin\AppData\Local\Temp\sesnaestzupa.exe"4⤵
- Executes dropped EXE
PID:528
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD54a69a5aaec05604e43612f025a3137dc
SHA12a42aaf1ec649d882f8faa7018b0a996616d11ca
SHA2565a39b90268e60068ab104fca228b90ae9ca8b13a3778cbf86c2aa1131d83b66e
SHA512d457ecb47105820c09aefd8a7229a1ba9944cbc46b6af1c95f89ef6e1c929a1c2a459dbae31d03b19cd171eb208b6e1ea291702a024c0aebcd030b1d3bf5c93f