0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
Size

196KB
MD5

ff8278655cd1407af30c403a7803e644
SHA1

c96d6e51eb8520a76e416e24f3508990e00253d2
SHA256

0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e
SHA512

b4d0dffea25ba62071180c0d5ef9c86de269644485ae85022148792795e8b9b77e6e786cc8995a764ac54c45b14bc454b1729781de0ee5cd53381d269ba54749
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOl:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXg

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1228	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2128	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1228	2128	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	29
PID 2128 wrote to memory of 1228	2128	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	29
PID 2128 wrote to memory of 1228	2128	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	29
PID 2128 wrote to memory of 1228	2128	0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe	29

C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
"C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0D6BBD~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1228

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\rwmhost.exe

Filesize
196KB

MD5
c02120fa1d68610a5fe1f50a09d59820

SHA1
e282eb3071c94ff410085f1db2464969a8b3b791

SHA256
3763cc7657ef55e2bbed43190b813c0dbe998ac0178f8265b8e746e400edbda2

SHA512
cb8911913946c86261e5b5e8c6ecd1e6903728e969d1734c7c2f11c966ebfeddb87ca6486aa957729ba294ebbf68d4c7bc3750c699c9966ad33c1cb2a00d83fe

Download Submit