Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 17:40
Static task
static1
Behavioral task
behavioral1
Sample
8fc24407671c79b675c98492ace8f104.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8fc24407671c79b675c98492ace8f104.exe
Resource
win10v2004-20231215-en
General
-
Target
8fc24407671c79b675c98492ace8f104.exe
-
Size
14KB
-
MD5
8fc24407671c79b675c98492ace8f104
-
SHA1
ba12301c575c94aec20f5986d0550eb9c8825979
-
SHA256
d98aab09f963cdc05a6c8e77bd0a75ab45075998b423c67b5edf59ee6371ae1b
-
SHA512
b8f1e6369ab625d3540aeb40be0714637c674e5cb7bacde49d24b263f8dd10f78de20b690eaeebe1a67af47f2ae3975f502bc7fb6df79bdc3ceee0f4340749cc
-
SSDEEP
384:AZGxEZ5FT3Ntxk3Bj93qmmuxBxVppBYklN18ilvHM9QrTUU3WZ0zrze:DOZ5Bq3qm3xbpBYklL8iJkwIS/zne
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\zxeoddrq.dll = "{D3112B69-A745-4805-874E-ABD480EA1299}" 8fc24407671c79b675c98492ace8f104.exe -
Loads dropped DLL 1 IoCs
pid Process 3636 8fc24407671c79b675c98492ace8f104.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zxeoddrq.nls 8fc24407671c79b675c98492ace8f104.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3112B69-A745-4805-874E-ABD480EA1299} 8fc24407671c79b675c98492ace8f104.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3112B69-A745-4805-874E-ABD480EA1299}\InProcServer32 8fc24407671c79b675c98492ace8f104.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3112B69-A745-4805-874E-ABD480EA1299}\InProcServer32\ = "C:\\Windows\\SysWow64\\zxeoddrq.dll" 8fc24407671c79b675c98492ace8f104.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3112B69-A745-4805-874E-ABD480EA1299}\InProcServer32\ThreadingModel = "Apartment" 8fc24407671c79b675c98492ace8f104.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3636 8fc24407671c79b675c98492ace8f104.exe 3636 8fc24407671c79b675c98492ace8f104.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3636 8fc24407671c79b675c98492ace8f104.exe 3636 8fc24407671c79b675c98492ace8f104.exe 3636 8fc24407671c79b675c98492ace8f104.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3636 wrote to memory of 1316 3636 8fc24407671c79b675c98492ace8f104.exe 93 PID 3636 wrote to memory of 1316 3636 8fc24407671c79b675c98492ace8f104.exe 93 PID 3636 wrote to memory of 1316 3636 8fc24407671c79b675c98492ace8f104.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fc24407671c79b675c98492ace8f104.exe"C:\Users\Admin\AppData\Local\Temp\8fc24407671c79b675c98492ace8f104.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\BC1C.tmp.bat2⤵PID:1316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD5de42ab264bf73f41d7b9ef3240c5f4ea
SHA179888c22ed30916cc13a4ab2d3cfc08ad1cfa98a
SHA2560c72e28d7b1ef785b379037053fb48cc299f8230ee22de2347d7f8485a477871
SHA5125b2bd34aec956f27d6f665a565a57bfaa8ac5bcf1a3bbf1868565ada4e81279c4073fc57fe03995b06779f782226a059d42b5a432e1d4e5589dc507d58f8587b
-
Filesize
2.2MB
MD5a739ecabba6d6d1c1e6a6d832cde9cac
SHA1d92068a1c25ab517d1705bc3e8b2d852de768f3e
SHA2564eaf1b25b28a0c47b285bf389de0e4bfc235d8594402c08887846dd13fdfe83b
SHA512f5921dbb565f70a096b946117afc88baf102b3ac934191c41cd5a468876569bf11d9079a141254907380bc83e3c0d46edf3e59369b3a475c0e07b61cffa8d3d8
-
Filesize
428B
MD57e0c77eb9b53559c85289cc0490213f0
SHA1ed052fcaa5fdd4770650882c289f68908fccc287
SHA2560fb3c6508bbdbb6416f4b709204d666387acc7583c1eef488bbd87eb400bd426
SHA51270896a7ab3317aa7838a4843cf2390f12e7ea7caea49eb62161a3dbd709688a1865a0f560bc527335d7aa2033bfd2ce33088daef2b7114e20f3a43ed8d3427c7