806b8555b7c1c0eb27035a59a27ec56a3510a2911255788b0af60fd85949658d

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a1beb459414fce28ae4b67deefc0845.exe
Size

154KB
MD5

5a1beb459414fce28ae4b67deefc0845
SHA1

18b49d86b0f444f173565240a60da23551369cfe
SHA256

806b8555b7c1c0eb27035a59a27ec56a3510a2911255788b0af60fd85949658d
SHA512

c2c5fde7a8af2481a5628c85643f6cb611c2debc1845557386efbc94505b2f2fd72a368d7a229702d2df8fe49a4400b506829d14370e5586e84786649f4941be
SSDEEP

3072:CMftVuhLu/Y34erRH86rPYFAM5vTK3clMdisNDtI1rW:WGY3JdPrBIOiWDKrW

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
4628	eduqotl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\rsektfh.dll	eduqotl.exe
File created	C:\PROGRA~3\Mozilla\eduqotl.exe	5a1beb459414fce28ae4b67deefc0845.exe

C:\Users\Admin\AppData\Local\Temp\5a1beb459414fce28ae4b67deefc0845.exe
"C:\Users\Admin\AppData\Local\Temp\5a1beb459414fce28ae4b67deefc0845.exe"
1⤵
- Drops file in Program Files directory
PID:4412

C:\PROGRA~3\Mozilla\eduqotl.exe
C:\PROGRA~3\Mozilla\eduqotl.exe -gorczwk
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\eduqotl.exe

Filesize
154KB

MD5
63c99be2d3c97552926e66f30adf922a

SHA1
3d31cd0ac2083c0f286585c6f9666b7bd99745e2

SHA256
7358eff7d3d1106634fc58b6dfada1c9a22c51deaada58b975c52d761fab093a

SHA512
f40e7050cf24e304cc77f6bcd336dd92863239a6b70944ce743445bc5549a0deb520d7e6cd21e957df36508d45c824c582e22a5b1c5ee6002b8882854ec7af30

Download Submit
memory/4412-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4412-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4412-2-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4412-3-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4412-9-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4628-10-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4628-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download