52050645ac04f7c18db1f1bc3ca38774ed407fac151f0806c3f667aec2aa0ac5

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fd2753ef741e0848cc4667b21f46e91.exe
Size 92KB
Sample240122-vfxb8abbg8
SHA256 52050645ac04f7c18db1f1bc3ca38774ed407fac151f0806c3f667aec2aa0ac5
MD5 6fd2753ef741e0848cc4667b21f46e91
SHA1 b95f82be814e9e05b9c39355b2b26295cc007316
SHA512 50f8cc2d4240f4d53dc6f85799f9f37301e2db0657987e271f7beee7df32a620a7d455511061115e4f1214bdcd8caae67cfe5debaf60f4497cee5a1e0569eb58
SSDEEP 768:XV4WwUpyNxMN+sHGCW1sH/z+RWjBURC+cAHVFTmh/BwL7Ne1tK:XeWwbyjHzQsH/muBURCC1Fk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2044	6fd2753ef741e0848cc4667b21f46e91.exe
3308	Rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winabc = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\6fd2753ef741e0848cc4667b21f46e91.dll,abcLaunchEv"	6fd2753ef741e0848cc4667b21f46e91.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2044	6fd2753ef741e0848cc4667b21f46e91.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	Rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3308	2044	6fd2753ef741e0848cc4667b21f46e91.exe	88
PID 2044 wrote to memory of 3308	2044	6fd2753ef741e0848cc4667b21f46e91.exe	88
PID 2044 wrote to memory of 3308	2044	6fd2753ef741e0848cc4667b21f46e91.exe	88
PID 2044 wrote to memory of 4148	2044	6fd2753ef741e0848cc4667b21f46e91.exe	89
PID 2044 wrote to memory of 4148	2044	6fd2753ef741e0848cc4667b21f46e91.exe	89
PID 2044 wrote to memory of 4148	2044	6fd2753ef741e0848cc4667b21f46e91.exe	89

C:\Users\Admin\AppData\Local\Temp\6fd2753ef741e0848cc4667b21f46e91.exe
"C:\Users\Admin\AppData\Local\Temp\6fd2753ef741e0848cc4667b21f46e91.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\Rundll32.exe
  Rundll32.exe C:\Users\Admin\AppData\Local\Temp\6fd2753ef741e0848cc4667b21f46e91.dll,abcLaunchEv
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\6FD275~1.EXE > nul
  2⤵
  PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6fd2753ef741e0848cc4667b21f46e91.dll

Path C:\Users\Admin\AppData\Local\Temp\6fd2753ef741e0848cc4667b21f46e91.dll
Size 44KB
SHA256 81717a598774729f4831f8d5338f34a7c275160798dcd797b0b6dca5fe2cd7ce
MD5 a9d934e1b781c32d81e1823201da1cb1
SHA1 64bde714927a2f47de8529a331d00340d995818b
SHA512 ea84d402941e5a00b664c8fd930c6c5a2e88470ddfd97daf01b00e08cbefa2bb6b08decb4c9e5df02372747fd544aee33fdb2584f2e72041fbb141d86cb96c2e
SSDEEP 384:gDnOMQFcN9wUJBljXhNOY4vA3gxnsXWw+sHATjCW1sH/z+RWjBURC:vWwUpyNxMN+sHGCW1sH/z+RWjBURC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2044-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2044-5-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads