Analysis
-
max time kernel
63s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-01-2024 04:20
Static task
static1
Behavioral task
behavioral1
Sample
765e7c536aaca5b29228227b7e4c0c54.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
765e7c536aaca5b29228227b7e4c0c54.exe
Resource
win10v2004-20231215-en
General
-
Target
765e7c536aaca5b29228227b7e4c0c54.exe
-
Size
257KB
-
MD5
765e7c536aaca5b29228227b7e4c0c54
-
SHA1
d4aac6b46ae174d4adff8c114ab4eb6f957f2ce8
-
SHA256
bcde1a1b358288bda4eeb85088703c509df57719c60b5417d4c1c56bdc631d24
-
SHA512
580318010e0f98419eea5a40d11d933280bb10a05d918edd331b57b5fd054b1141465b8c1ab3dfba99d633416496f0ec248398156d38f297ca1ea5a411848efa
-
SSDEEP
6144:SNCMjUidDzOW8qGt8WP9Itvy5UnByKtIr89VhsKCAArs5Jn7u:SkMjFOW8q6JVItvtnB4rWhsKCAArs5JK
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\a98ee895\\X" Explorer.EXE -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2936 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exeXpid process 340 csrss.exe 2664 X -
Loads dropped DLL 2 IoCs
Processes:
765e7c536aaca5b29228227b7e4c0c54.exepid process 2288 765e7c536aaca5b29228227b7e4c0c54.exe 2288 765e7c536aaca5b29228227b7e4c0c54.exe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 69.64.52.10 Destination IP 69.64.52.10 Destination IP 69.64.52.10 Destination IP 69.64.52.10 Destination IP 69.64.52.10 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
765e7c536aaca5b29228227b7e4c0c54.exedescription pid process target process PID 2288 set thread context of 2936 2288 765e7c536aaca5b29228227b7e4c0c54.exe cmd.exe -
Modifies registry class 3 IoCs
Processes:
765e7c536aaca5b29228227b7e4c0c54.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{bfa737fc-a273-1bb3-d4a0-adf310963e7d}\cid = "13573764572684242185" 765e7c536aaca5b29228227b7e4c0c54.exe Key created \registry\machine\Software\Classes\Interface\{bfa737fc-a273-1bb3-d4a0-adf310963e7d} 765e7c536aaca5b29228227b7e4c0c54.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{bfa737fc-a273-1bb3-d4a0-adf310963e7d}\u = "40" 765e7c536aaca5b29228227b7e4c0c54.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
765e7c536aaca5b29228227b7e4c0c54.exeXpid process 2288 765e7c536aaca5b29228227b7e4c0c54.exe 2288 765e7c536aaca5b29228227b7e4c0c54.exe 2288 765e7c536aaca5b29228227b7e4c0c54.exe 2288 765e7c536aaca5b29228227b7e4c0c54.exe 2664 X -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
765e7c536aaca5b29228227b7e4c0c54.exedescription pid process Token: SeDebugPrivilege 2288 765e7c536aaca5b29228227b7e4c0c54.exe Token: SeDebugPrivilege 2288 765e7c536aaca5b29228227b7e4c0c54.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
csrss.exepid process 340 csrss.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
765e7c536aaca5b29228227b7e4c0c54.exeXcsrss.exedescription pid process target process PID 2288 wrote to memory of 1196 2288 765e7c536aaca5b29228227b7e4c0c54.exe Explorer.EXE PID 2288 wrote to memory of 340 2288 765e7c536aaca5b29228227b7e4c0c54.exe csrss.exe PID 2288 wrote to memory of 2664 2288 765e7c536aaca5b29228227b7e4c0c54.exe X PID 2288 wrote to memory of 2664 2288 765e7c536aaca5b29228227b7e4c0c54.exe X PID 2288 wrote to memory of 2664 2288 765e7c536aaca5b29228227b7e4c0c54.exe X PID 2288 wrote to memory of 2664 2288 765e7c536aaca5b29228227b7e4c0c54.exe X PID 2664 wrote to memory of 1196 2664 X Explorer.EXE PID 2288 wrote to memory of 2936 2288 765e7c536aaca5b29228227b7e4c0c54.exe cmd.exe PID 2288 wrote to memory of 2936 2288 765e7c536aaca5b29228227b7e4c0c54.exe cmd.exe PID 2288 wrote to memory of 2936 2288 765e7c536aaca5b29228227b7e4c0c54.exe cmd.exe PID 2288 wrote to memory of 2936 2288 765e7c536aaca5b29228227b7e4c0c54.exe cmd.exe PID 2288 wrote to memory of 2936 2288 765e7c536aaca5b29228227b7e4c0c54.exe cmd.exe PID 340 wrote to memory of 2360 340 csrss.exe WMIADAP.EXE PID 340 wrote to memory of 2360 340 csrss.exe WMIADAP.EXE PID 340 wrote to memory of 1620 340 csrss.exe wmiprvse.exe PID 340 wrote to memory of 1620 340 csrss.exe wmiprvse.exe
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\765e7c536aaca5b29228227b7e4c0c54.exe"C:\Users\Admin\AppData\Local\Temp\765e7c536aaca5b29228227b7e4c0c54.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\a98ee895\X*0*28*43a04d09*69.64.52.10:533⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\a98ee895\XFilesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
\Windows\System32\consrv.dllFilesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}Filesize
2KB
MD5840290827ac3652b26105649df454770
SHA13fb27e2a4cf094e56cd0a111ea85a753ad8ef27a
SHA256cfba1f8ed24d4cbae51e14a582b03b950d346292809f90c038e2446e25ce662a
SHA5122bb6fe7a370c37b1f4c54d4a375069ccd2621506045335e1f9c47f6f4d39495f17af83e1ee8f84dd3b2ee7f7d6415c15cbb7b8325cd4e20832bb42d0d796087c
-
memory/340-27-0x0000000000E40000-0x0000000000E4B000-memory.dmpFilesize
44KB
-
memory/340-43-0x0000000002500000-0x0000000002502000-memory.dmpFilesize
8KB
-
memory/340-17-0x0000000000E40000-0x0000000000E4B000-memory.dmpFilesize
44KB
-
memory/340-26-0x0000000002500000-0x0000000002502000-memory.dmpFilesize
8KB
-
memory/1196-3-0x0000000002510000-0x0000000002516000-memory.dmpFilesize
24KB
-
memory/1196-12-0x0000000002500000-0x0000000002502000-memory.dmpFilesize
8KB
-
memory/1196-36-0x0000000002530000-0x000000000253B000-memory.dmpFilesize
44KB
-
memory/1196-32-0x0000000002530000-0x000000000253B000-memory.dmpFilesize
44KB
-
memory/1196-28-0x0000000002530000-0x000000000253B000-memory.dmpFilesize
44KB
-
memory/1196-38-0x0000000000E40000-0x0000000000E4B000-memory.dmpFilesize
44KB
-
memory/1196-39-0x0000000002540000-0x000000000254B000-memory.dmpFilesize
44KB
-
memory/1196-37-0x0000000002540000-0x000000000254B000-memory.dmpFilesize
44KB
-
memory/1196-7-0x0000000002510000-0x0000000002516000-memory.dmpFilesize
24KB
-
memory/1196-11-0x0000000002510000-0x0000000002516000-memory.dmpFilesize
24KB
-
memory/1196-44-0x0000000000E40000-0x0000000000E4B000-memory.dmpFilesize
44KB
-
memory/2288-1-0x0000000030670000-0x00000000306C2000-memory.dmpFilesize
328KB
-
memory/2288-42-0x0000000030670000-0x00000000306C2000-memory.dmpFilesize
328KB
-
memory/2288-41-0x0000000000410000-0x0000000000510000-memory.dmpFilesize
1024KB
-
memory/2288-40-0x0000000030670000-0x00000000306C2000-memory.dmpFilesize
328KB
-
memory/2288-2-0x0000000000410000-0x0000000000510000-memory.dmpFilesize
1024KB