Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:30
Static task
static1
Behavioral task
behavioral1
Sample
74f8feae1380c4a530344c0b602f8703.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
74f8feae1380c4a530344c0b602f8703.exe
Resource
win10v2004-20231215-en
General
-
Target
74f8feae1380c4a530344c0b602f8703.exe
-
Size
449KB
-
MD5
74f8feae1380c4a530344c0b602f8703
-
SHA1
960b8c1dcd726dc646900fe4dbe602e8d3f8d72f
-
SHA256
e4094334ca77406cbf25630e2b96a1723d264e17db2c1320d03f439e945f5648
-
SHA512
de478079e1d324533c4eeca1af4c997306e8677b57ae2dd85e0b8dce87ed0467fc6720d328fc7ca6bc77f3193544bdc1799127e3dd00dcf2459b6dff0b91ecfc
-
SSDEEP
12288:Ld64QXqIQXBUXINsmUYYBrUXXyEsPSep+wkVTIY2yeWDC3U2W:gHgxUXJmVkrUXCEszRkVUY2eDC3U2W
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
kM10400CiJcB10400.exepid process 1936 kM10400CiJcB10400.exe -
Executes dropped EXE 1 IoCs
Processes:
kM10400CiJcB10400.exepid process 1936 kM10400CiJcB10400.exe -
Loads dropped DLL 2 IoCs
Processes:
74f8feae1380c4a530344c0b602f8703.exepid process 2084 74f8feae1380c4a530344c0b602f8703.exe 2084 74f8feae1380c4a530344c0b602f8703.exe -
Processes:
resource yara_rule behavioral1/memory/2084-17-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1936-20-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1936-30-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/1936-40-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
kM10400CiJcB10400.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kM10400CiJcB10400 = "C:\\ProgramData\\kM10400CiJcB10400\\kM10400CiJcB10400.exe" kM10400CiJcB10400.exe -
Processes:
kM10400CiJcB10400.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main kM10400CiJcB10400.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
74f8feae1380c4a530344c0b602f8703.exekM10400CiJcB10400.exepid process 2084 74f8feae1380c4a530344c0b602f8703.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
74f8feae1380c4a530344c0b602f8703.exekM10400CiJcB10400.exedescription pid process Token: SeDebugPrivilege 2084 74f8feae1380c4a530344c0b602f8703.exe Token: SeDebugPrivilege 1936 kM10400CiJcB10400.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
kM10400CiJcB10400.exepid process 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
kM10400CiJcB10400.exepid process 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
kM10400CiJcB10400.exepid process 1936 kM10400CiJcB10400.exe 1936 kM10400CiJcB10400.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
74f8feae1380c4a530344c0b602f8703.exedescription pid process target process PID 2084 wrote to memory of 1936 2084 74f8feae1380c4a530344c0b602f8703.exe kM10400CiJcB10400.exe PID 2084 wrote to memory of 1936 2084 74f8feae1380c4a530344c0b602f8703.exe kM10400CiJcB10400.exe PID 2084 wrote to memory of 1936 2084 74f8feae1380c4a530344c0b602f8703.exe kM10400CiJcB10400.exe PID 2084 wrote to memory of 1936 2084 74f8feae1380c4a530344c0b602f8703.exe kM10400CiJcB10400.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f8feae1380c4a530344c0b602f8703.exe"C:\Users\Admin\AppData\Local\Temp\74f8feae1380c4a530344c0b602f8703.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\ProgramData\kM10400CiJcB10400\kM10400CiJcB10400.exe"C:\ProgramData\kM10400CiJcB10400\kM10400CiJcB10400.exe" "C:\Users\Admin\AppData\Local\Temp\74f8feae1380c4a530344c0b602f8703.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\kM10400CiJcB10400\kM10400CiJcB10400.exeFilesize
449KB
MD594ebc34bd65ff1e21a81f9565ebb85cc
SHA17c228b8992d6fb1334d8fec7504008244b9940b1
SHA2566908db4e4d5962924f5e57052352b464d9b52387a69679675ae626c3f1e7d491
SHA5124b1b5a4e818a64323f572c811215460d525e91f624828bbd0f6498417edda09f2d855e9884b55535a4d222c6b8c533629536a210443c8b1c1b5409b0e0eb6337
-
memory/1936-20-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1936-21-0x0000000000620000-0x0000000000720000-memory.dmpFilesize
1024KB
-
memory/1936-30-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/1936-32-0x0000000000620000-0x0000000000720000-memory.dmpFilesize
1024KB
-
memory/1936-40-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2084-1-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2084-2-0x00000000002A0000-0x00000000003A0000-memory.dmpFilesize
1024KB
-
memory/2084-17-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB