a46b7cd58efb64bc095bdace2e1b90d6bf31922006426c1f89166e46e09e2500

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b596827775c0c50eda4286b70630737.exe
Size

132KB
MD5

4b596827775c0c50eda4286b70630737
SHA1

1f2148c769e49b3ec2ffbc1e8018b29739df4853
SHA256

a46b7cd58efb64bc095bdace2e1b90d6bf31922006426c1f89166e46e09e2500
SHA512

ac207c415049a19dea9e42166c99e8dfbf74a8930690436fd730ca0f2f40a319be200eebc98eb6f30795d0e911175ea1c80f64c3820b8efb30affd4667e07402
SSDEEP

3072:FLQdOPskC6N13sbivD/tN8bIOslG73fuOgKOlRUJgBSI6:dFCSds+vDlNyIOslwfuOgtS

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4744	rundll32.exe
2056	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mwixebo = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\dorede.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe
4744	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
400	4b596827775c0c50eda4286b70630737.exe
4744	rundll32.exe
2056	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4744	400	4b596827775c0c50eda4286b70630737.exe	89
PID 400 wrote to memory of 4744	400	4b596827775c0c50eda4286b70630737.exe	89
PID 400 wrote to memory of 4744	400	4b596827775c0c50eda4286b70630737.exe	89
PID 4744 wrote to memory of 2056	4744	rundll32.exe	103
PID 4744 wrote to memory of 2056	4744	rundll32.exe	103
PID 4744 wrote to memory of 2056	4744	rundll32.exe	103

C:\Users\Admin\AppData\Local\Temp\4b596827775c0c50eda4286b70630737.exe
"C:\Users\Admin\AppData\Local\Temp\4b596827775c0c50eda4286b70630737.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\dorede.dll",Startup
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\dorede.dll",iep
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\dorede.dll

Filesize
132KB

MD5
61e4eee668cc2526b29d8911e68186a6

SHA1
378d9db1de5691867da0fbd855bc2748b9220445

SHA256
7f5f0b61e6221504f5c20c8619648fbad15507d6eb33cd21f9b0ea8d239c4dd2

SHA512
4b31bd01782e1fcd2fa92578e9b02165185e8083dc8b59cffba2625701dac6d437d1ad2cebe872cfd8bae6fe0c7b0d24c0c17adbb91403763e8609b2a5b0b095

Download Submit
memory/400-10-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/400-1-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/400-2-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/400-0-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/400-15-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/400-14-0x0000000002360000-0x0000000002370000-memory.dmp

Filesize
64KB

Download
memory/2056-23-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Filesize
64KB

Download
memory/2056-26-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/2056-30-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Filesize
64KB

Download
memory/2056-29-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Filesize
64KB

Download
memory/2056-22-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Filesize
64KB

Download
memory/4744-17-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4744-21-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4744-16-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4744-7-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4744-25-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4744-11-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4744-8-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4744-9-0x0000000002350000-0x0000000002360000-memory.dmp

Filesize
64KB

Download
memory/4744-33-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download
memory/4744-35-0x0000000010000000-0x0000000010021000-memory.dmp

Filesize
132KB

Download