Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14-01-2024 06:29
Static task
static1
Behavioral task
behavioral1
Sample
5a864c3c4a5c37d822447f6fa76024a5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a864c3c4a5c37d822447f6fa76024a5.exe
Resource
win10v2004-20231222-en
General
-
Target
5a864c3c4a5c37d822447f6fa76024a5.exe
-
Size
408KB
-
MD5
5a864c3c4a5c37d822447f6fa76024a5
-
SHA1
c58bd04b675fe46de542d8864fb217e0d07cacce
-
SHA256
77dcfe4f6402827ed7b3bee0636530a111a73e54964647c0977192731d84c56c
-
SHA512
d3cd3e276b58842aa6824e076f65e1005742d6c9935fb953b4ae5d63b5ff3c6bf62351e75f858370c94071985965d22480e71c82e82faab5c08cdbcfdaf9848e
-
SSDEEP
12288:OFAypKUXaBOzJdqxXNfRQ6kTNmTORtVFw0UoZA:OW2vd4NfRQpTsu53ZA
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
serhur45hu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hrt54is56ijfgte.exe" serhur45hu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hrt54is56ijfgte.exe" serhur45hu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
serhur45hu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" serhur45hu.exe -
Disables Task Manager via registry modification
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
serhur45hu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GjPEEl6E-E6bb-bcZn-Gtsv-dAgH6KqQHsxT} serhur45hu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{GjPEEl6E-E6bb-bcZn-Gtsv-dAgH6KqQHsxT}\6zvcaxR5ls4KB9Y = "\"C:\\Users\\Admin\\AppData\\Roaming\\hrt54is56ijfgte.exe\" /ActiveX" serhur45hu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5a864c3c4a5c37d822447f6fa76024a5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 5a864c3c4a5c37d822447f6fa76024a5.exe -
Executes dropped EXE 2 IoCs
Processes:
serhur45hu.exeserhur45hu.exepid process 4996 serhur45hu.exe 4416 serhur45hu.exe -
Loads dropped DLL 2 IoCs
Processes:
serhur45hu.exepid process 4416 serhur45hu.exe 4416 serhur45hu.exe -
Processes:
resource yara_rule behavioral2/memory/4416-20-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4416-23-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4416-25-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4416-24-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4416-22-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral2/memory/4416-41-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
serhur45hu.exereg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6zvcaxR5ls4KB9Y = "C:\\Users\\Admin\\AppData\\Roaming\\hrt54is56ijfgte.exe" serhur45hu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sr5tuhsrt6xhjudry6 = "C:\\Users\\Admin\\AppData\\Roaming\\hsr5uyhrxt\\serhur45hu.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6zvcaxR5ls4KB9Y = "C:\\Users\\Admin\\AppData\\Roaming\\hrt54is56ijfgte.exe" serhur45hu.exe -
Processes:
serhur45hu.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA serhur45hu.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
serhur45hu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ serhur45hu.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
serhur45hu.exedescription pid process target process PID 4996 set thread context of 4416 4996 serhur45hu.exe serhur45hu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
serhur45hu.exepid process 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
5a864c3c4a5c37d822447f6fa76024a5.exeserhur45hu.exeserhur45hu.exepid process 1280 5a864c3c4a5c37d822447f6fa76024a5.exe 4996 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe 4416 serhur45hu.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
5a864c3c4a5c37d822447f6fa76024a5.execmd.exeserhur45hu.exedescription pid process target process PID 1280 wrote to memory of 2860 1280 5a864c3c4a5c37d822447f6fa76024a5.exe cmd.exe PID 1280 wrote to memory of 2860 1280 5a864c3c4a5c37d822447f6fa76024a5.exe cmd.exe PID 1280 wrote to memory of 2860 1280 5a864c3c4a5c37d822447f6fa76024a5.exe cmd.exe PID 2860 wrote to memory of 6076 2860 cmd.exe reg.exe PID 2860 wrote to memory of 6076 2860 cmd.exe reg.exe PID 2860 wrote to memory of 6076 2860 cmd.exe reg.exe PID 1280 wrote to memory of 4996 1280 5a864c3c4a5c37d822447f6fa76024a5.exe serhur45hu.exe PID 1280 wrote to memory of 4996 1280 5a864c3c4a5c37d822447f6fa76024a5.exe serhur45hu.exe PID 1280 wrote to memory of 4996 1280 5a864c3c4a5c37d822447f6fa76024a5.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe PID 4996 wrote to memory of 4416 4996 serhur45hu.exe serhur45hu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a864c3c4a5c37d822447f6fa76024a5.exe"C:\Users\Admin\AppData\Local\Temp\5a864c3c4a5c37d822447f6fa76024a5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240605062.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sr5tuhsrt6xhjudry6" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\serhur45hu.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\serhur45hu.exe"C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\serhur45hu.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\serhur45hu.exe"C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\serhur45hu.exe"3⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\240605062.batFilesize
159B
MD5a80658d9ea7c0ddebccbe6de91b34b20
SHA10ee816fbd7dde9db479e9a22a70a1318a9f40e06
SHA256a78032a0a6ba3f51f1c94a9527247c4b69af3d42922095968fbcb81ab23147f6
SHA512f861719d968e2926702d4b45e436c89afee97f07eabf8355f4fa21a85411908e8a5a664f7b47fc1deaccbfe2de293d19b4d86499d982c6045cd9faee22ba3a19
-
C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\dwlGina3.dllFilesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
C:\Users\Admin\AppData\Roaming\hsr5uyhrxt\serhur45hu.exeFilesize
408KB
MD5d64b3a3f412975f82af55bc01b1e005f
SHA1033ebc32d070dc97caf13d8344c17012d845e5d0
SHA2560aa8474ae9862d53ee4cac56101b4654affded1d706295e2e0d32523552cea48
SHA51232518ee8325cfba58ca8e3e4306c9671ccca1a52372621b3a51bf3bc38e28ffb155d9fbf96d5099885197d2f0a01304662e3bc0b807828a75b7a039efa2e5e1a
-
memory/4416-24-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4416-28-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/4416-25-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4416-23-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4416-32-0x00000000022D0000-0x00000000022EC000-memory.dmpFilesize
112KB
-
memory/4416-20-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4416-22-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4416-42-0x00000000022D0000-0x00000000022EC000-memory.dmpFilesize
112KB
-
memory/4416-41-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4416-45-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB