Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 11:46
Behavioral task
behavioral1
Sample
4e37c3ae5dbf6894974355d260f3f5ec.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e37c3ae5dbf6894974355d260f3f5ec.exe
Resource
win10v2004-20231215-en
General
-
Target
4e37c3ae5dbf6894974355d260f3f5ec.exe
-
Size
765KB
-
MD5
4e37c3ae5dbf6894974355d260f3f5ec
-
SHA1
255d3578c30956752872e62aec1143c72e6b8f3c
-
SHA256
6eb47f0ba97758b106cd8c33204491a38bf99758c297898d712defd91054b055
-
SHA512
8ef1d85091786bd3fe16b14f06b73514f2048b5c299a714ab525d8eb5548bd7e8fbbccf656469141ee52961a73498b89f28576a8140b6e8179a6aae8311fb811
-
SSDEEP
12288:wmclQvlezdIU5FPq/xuI9IH1+GkylWbeBersBvhXBOeVK7+ZflO9dJ5IECpxOok3:TlvEdt8Z1+9kycagr8ZBxDcjukL2Y
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe -
Executes dropped EXE 1 IoCs
pid Process 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe -
Loads dropped DLL 1 IoCs
pid Process 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe -
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000b000000012251-11.dat upx behavioral1/files/0x000b000000012251-15.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2812 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 4e37c3ae5dbf6894974355d260f3f5ec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 4e37c3ae5dbf6894974355d260f3f5ec.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 4e37c3ae5dbf6894974355d260f3f5ec.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 4e37c3ae5dbf6894974355d260f3f5ec.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2872 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe 29 PID 1716 wrote to memory of 2872 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe 29 PID 1716 wrote to memory of 2872 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe 29 PID 1716 wrote to memory of 2872 1716 4e37c3ae5dbf6894974355d260f3f5ec.exe 29 PID 2872 wrote to memory of 2812 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 31 PID 2872 wrote to memory of 2812 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 31 PID 2872 wrote to memory of 2812 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 31 PID 2872 wrote to memory of 2812 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 31 PID 2872 wrote to memory of 2980 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 34 PID 2872 wrote to memory of 2980 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 34 PID 2872 wrote to memory of 2980 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 34 PID 2872 wrote to memory of 2980 2872 4e37c3ae5dbf6894974355d260f3f5ec.exe 34 PID 2980 wrote to memory of 2728 2980 cmd.exe 32 PID 2980 wrote to memory of 2728 2980 cmd.exe 32 PID 2980 wrote to memory of 2728 2980 cmd.exe 32 PID 2980 wrote to memory of 2728 2980 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe"C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exeC:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe" /TN U5Z8sQiHf24d /F3⤵
- Creates scheduled task(s)
PID:2812
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN U5Z8sQiHf24d > C:\Users\Admin\AppData\Local\Temp\BUr1Fp1vF.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2980
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN U5Z8sQiHf24d1⤵PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
765KB
MD5bb69d74f3b324c9cacf894fed0e9e3f4
SHA107dce2dc6b233a600360862719e348dcadd54ca4
SHA256ce131081adfd562ec14e66dbab6a1c608b943f87d2fe0039a3ae18525d19d7b4
SHA512062315b1f05d40dd2d1ab33bd9044fec542ae822029dbfc070dbc7728b2f3ea9488ba577758aab2a58a6fcdbb6a754da9424725cae5d7e3f21d2e7a5e0c93c01
-
Filesize
382KB
MD5c0d69aa15607658340ed86b6656f638d
SHA13fb5e8f8880cc92562582dfdbbeda8cf75c696ec
SHA256f381405e4e2d0ff2d7ab7552fd3a48b385eeb4aafbe3c2534b7ceafd6167e0a4
SHA5128399d386f9c407bc73fdcb5fca874db7dd8cd32af0040a73466ab3eec8aa7dcede19fbd4e1906ed1e9aa2eec4218ea88de7c3f93acadd5a4f3b021afdc1da3d1