75f785ffbadc7cc740bde0ed0c60159b1d380e203963228b5da20a94d4aa4a36

Analysis

max time kernel
130s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

srodus.exe
Size

152KB
MD5

a9611e59f5b26530f2f0b63da3847228
SHA1

e8ebf8efd94b42f0578392483d88aa237d261543
SHA256

e45438fb72a822ad3f3d1578bcbcc88e1f66d14ca6c3b6a620812d6191ed343d
SHA512

e9b8a0ad66e03d87bb5b4fd89ffcdce5879cc3724290aeda4e85620611681d7311dcfea685cfb574d34732daa8417607a3b769a5839b01846377595a67ed74fd
SSDEEP

3072:wf4Zp1MIrIf4lO6VogYx4q+wZoCXiZxnLWmEj:LZpyIrIw1q+kPUL

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

msiexec.exe

pid	Process
3008	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

srodus.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IsSystemUpgradeComponentRegistered = "explorer \"C:\\Users\\Admin\\Documents\\msedge.exe\" "	srodus.exe

Drops file in Program Files directory 1 IoCs

Processes:

srodus.exe

description	ioc	Process
File created	C:\Program Files (x86)\msiexec.exe	srodus.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

srodus.exemsiexec.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	srodus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	srodus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msiexec.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

srodus.exemsiexec.exe

pid	Process
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
4888	srodus.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe
3008	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

srodus.exe

pid	Process
4888	srodus.exe
4888	srodus.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

srodus.exe

description	pid	Process	procid_target
PID 4888 wrote to memory of 3008	4888	srodus.exe	95
PID 4888 wrote to memory of 3008	4888	srodus.exe	95
PID 4888 wrote to memory of 3008	4888	srodus.exe	95
PID 4888 wrote to memory of 3008	4888	srodus.exe	95

C:\Users\Admin\AppData\Local\Temp\srodus.exe
"C:\Users\Admin\AppData\Local\Temp\srodus.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\msiexec.exe
  "C:\Program Files (x86)\msiexec.exe" -Puppet
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\msiexec.exe

Filesize
58KB

MD5
9d09dc1eda745a5f87553048e57620cf

SHA1
1d0c7cfca8104d06de1f08b97f28b3520c246cd7

SHA256
3a90ede157d40a4db7859158c826f7b4d0f19a5768f6483c9be6ee481c6e1af7

SHA512
2be940f0468f77792c6e1b593376900c24ff0b0fae8dc2e57b05596506789aa76119f8be780c57252f74cd1f0c2fa7223fe44ae4fa3643c26df00dd42bd4c016

Download Submit
C:\Users\Admin\Documents\msedge.exe

Filesize
152KB

MD5
a9611e59f5b26530f2f0b63da3847228

SHA1
e8ebf8efd94b42f0578392483d88aa237d261543

SHA256
e45438fb72a822ad3f3d1578bcbcc88e1f66d14ca6c3b6a620812d6191ed343d

SHA512
e9b8a0ad66e03d87bb5b4fd89ffcdce5879cc3724290aeda4e85620611681d7311dcfea685cfb574d34732daa8417607a3b769a5839b01846377595a67ed74fd

Download Submit
memory/4888-0-0x00000000023E0000-0x000000000242E000-memory.dmp

Filesize
312KB

Download
memory/4888-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download