3aef8c9325b46c0bbab0cfd13338d5d4f2c2ac3ad5f3f75dbcae591b7d608585

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54ccac2d3f02be8c0ef006f3aa978674.exe
Size 181KB
Sample240111-2ssm5aaadq
SHA256 3aef8c9325b46c0bbab0cfd13338d5d4f2c2ac3ad5f3f75dbcae591b7d608585
MD5 54ccac2d3f02be8c0ef006f3aa978674
SHA1 2dbd0e8639663bcc0bb9533c81ee15eda8fd482e
SHA512 c4e051743d1e551aa573eb38f95814e3a3f374d9667ff982f0855306b271fb488afc978b4504e11aed7cd03e02743f8760de81467b7ff8ccfd0e05b77b6cd11d
SSDEEP 3072:i3z7VejIGazuff9GqYY99s4nTd+niJP1YP+kS0rnsHotXvbe:iD7QjHaKff4qp9mC+nmP10Sqf6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4772	54ccac2d3f02be8c0ef006f3aa978674.exe
4772	54ccac2d3f02be8c0ef006f3aa978674.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 4772	2504	54ccac2d3f02be8c0ef006f3aa978674.exe	89

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HELP\F3C74E3FA248.dll	54ccac2d3f02be8c0ef006f3aa978674.exe
File opened for modification	C:\Windows\HELP\F3C74E3FA248.dll	54ccac2d3f02be8c0ef006f3aa978674.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32	54ccac2d3f02be8c0ef006f3aa978674.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ = "C:\\Windows\\HELP\\F3C74E3FA248.dll"	54ccac2d3f02be8c0ef006f3aa978674.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32\ThreadingModel = "Apartment"	54ccac2d3f02be8c0ef006f3aa978674.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}	54ccac2d3f02be8c0ef006f3aa978674.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\ = "SSUUDL"	54ccac2d3f02be8c0ef006f3aa978674.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2504	54ccac2d3f02be8c0ef006f3aa978674.exe
2504	54ccac2d3f02be8c0ef006f3aa978674.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4772	54ccac2d3f02be8c0ef006f3aa978674.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4772	2504	54ccac2d3f02be8c0ef006f3aa978674.exe	89
PID 2504 wrote to memory of 4772	2504	54ccac2d3f02be8c0ef006f3aa978674.exe	89
PID 2504 wrote to memory of 4772	2504	54ccac2d3f02be8c0ef006f3aa978674.exe	89
PID 2504 wrote to memory of 4772	2504	54ccac2d3f02be8c0ef006f3aa978674.exe	89
PID 2504 wrote to memory of 4772	2504	54ccac2d3f02be8c0ef006f3aa978674.exe	89
PID 4772 wrote to memory of 1828	4772	54ccac2d3f02be8c0ef006f3aa978674.exe	90
PID 4772 wrote to memory of 1828	4772	54ccac2d3f02be8c0ef006f3aa978674.exe	90
PID 4772 wrote to memory of 1828	4772	54ccac2d3f02be8c0ef006f3aa978674.exe	90
PID 4772 wrote to memory of 2160	4772	54ccac2d3f02be8c0ef006f3aa978674.exe	103
PID 4772 wrote to memory of 2160	4772	54ccac2d3f02be8c0ef006f3aa978674.exe	103
PID 4772 wrote to memory of 2160	4772	54ccac2d3f02be8c0ef006f3aa978674.exe	103

C:\Users\Admin\AppData\Local\Temp\54ccac2d3f02be8c0ef006f3aa978674.exe
"C:\Users\Admin\AppData\Local\Temp\54ccac2d3f02be8c0ef006f3aa978674.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\54ccac2d3f02be8c0ef006f3aa978674.exe
  C:\Users\Admin\AppData\Local\Temp\54ccac2d3f02be8c0ef006f3aa978674.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 2.bat
    3⤵
    PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 2.bat
    3⤵
    PID:2160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

2.bat

Path C:\Users\Admin\AppData\Local\Temp\2.bat
Size 64B
SHA256 6b76646756ccf7e17ac979e0aebf3ea6825d8f8b48000fef1ac548ad629d2c86
MD5 1d0c7ff0b7445114f4a15e9739e6dbb5
SHA1 49290edc205a81de310d2f674a0aa7deb025acc4
SHA512 d42ff7a86807499a7498054eae080dd27147fa559eede149e096c8a12a12713b39f274131a51bbb361bfb6993bbfc5d2334b554829eb5fb20cd45140172a65cd
MD5 SHA1 SHA512

Submit Download

2.bat

Path C:\Users\Admin\AppData\Local\Temp\2.bat
Size 63B
SHA256 8fb255625201cb6ec34180c2044bb7a72efbdcacacc1a27e947bd07ce5421d9c
MD5 82bf96e95a13cb3660834364b9c8c2aa
SHA1 e21d6044b589d77ed498ac13f173acd4fb86a0fb
SHA512 ba485f146128d4d7ec5625a911179c02f67ced4397ed011acbcced7abda1da2a8bb22f3a4e795d00be853ba3cb015b0966ea7fb0717bd315940306d4871c47d2
MD5 SHA1 SHA512

Submit Download

F3C74E3FA248.dll

Path C:\Windows\Help\F3C74E3FA248.dll
Size 140KB
SHA256 313d89ecf48755c9a019282c3236151484bd3121b2a964c9d384189bebca6485
MD5 03762459fad04d71846918235124196a
SHA1 74c8c69aead0bd8f5ddd9c9efbb48bfc99341809
SHA512 784acd2e8edf6628d4c756c2b7180f6ff5a8111a369fb513696ef0467c8eb40c4956d38108e2283a25d392e879c30a2d41e9fca13525292685f750aed9712a0a
SSDEEP 3072:GgcmiQOUwkshJY2FR67lDDJZgRM8dUue67gZlrIVatAvghoXnP7G77tyC:t8UChSrgTe67OCaqvgho3Pe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2504-1-0x0000000010000000-0x0000000010034000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4772-2-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4772-3-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4772-6-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/4772-15-0x0000000000690000-0x00000000006B8000-memory.dmp

Download

memory/4772-18-0x0000000000690000-0x00000000006B8000-memory.dmp

Download

memory/4772-19-0x0000000000400000-0x0000000000430000-memory.dmp

Download