b2486c3dc9f787d62a9783176a1315a51566df45473f590e99d5f02abbaae4c8

Analysis

max time kernel
151s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b5ddb2d9077a5d8967e1979e8ced82b.exe
Size

16KB
MD5

4b5ddb2d9077a5d8967e1979e8ced82b
SHA1

9e333eb67877fdfcf10594c3ddf4ff7d17262433
SHA256

b2486c3dc9f787d62a9783176a1315a51566df45473f590e99d5f02abbaae4c8
SHA512

e8802f390bcbca9327df3f66f9d90318856809a10f729ac8717b2217ce5f5a5b1f18bc3097eb6f8f080635fa5dc14dc6f8eee3200800f7958a0423c192c1b8cb
SSDEEP

384:KB2drIUa+i5h3mBqFxY8Yw6ObTbCAeDAjo0FO8wgCeeY5cGiR7g:KB2y9+i5h3mBqFxY8Yw6ObyvMj4XF

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2060	4b5ddb2d9077a5d8967e1979e8ced82b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\DbgHlp32 = "C:\\Windows\\DbgHlp32.exe"	4b5ddb2d9077a5d8967e1979e8ced82b.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DbgHlp32.dll	4b5ddb2d9077a5d8967e1979e8ced82b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\DbgHlp32.exe	4b5ddb2d9077a5d8967e1979e8ced82b.exe
File opened for modification	C:\Windows\DbgHlp32.exe	4b5ddb2d9077a5d8967e1979e8ced82b.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2060	4b5ddb2d9077a5d8967e1979e8ced82b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	4b5ddb2d9077a5d8967e1979e8ced82b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1200	2060	4b5ddb2d9077a5d8967e1979e8ced82b.exe	21
PID 2060 wrote to memory of 1200	2060	4b5ddb2d9077a5d8967e1979e8ced82b.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\4b5ddb2d9077a5d8967e1979e8ced82b.exe
  "C:\Users\Admin\AppData\Local\Temp\4b5ddb2d9077a5d8967e1979e8ced82b.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\DbgHlp32.dll

Filesize
26KB

MD5
5e155605fbaf65e96a1608e1f40a593f

SHA1
80556e4b404bc9d17389ea944ceac3715c25824e

SHA256
80a6b946fbf7e9bcdbdb96175d7ea81fff9283edaf2703fa82a0f8395ea8d191

SHA512
870407987c4633ff18eb4eeb72a0898e50eff7a2d845ece6f8c03af429bd108c9fb64e463fb48a6e7397cc17d2fbda865bbd5fa3f1ad91417fb04a8b9809fddb

Download Submit
memory/1200-3-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/2060-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2060-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2060-12-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download