94b065f515d58a6179a81b48fb5fc2df015871adc96f100cae29678ecdd83e0e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96e9acdff141d9c52f5c5172e76f2748.exe
Size

134KB
MD5

96e9acdff141d9c52f5c5172e76f2748
SHA1

0945c9866bf02970c988b4279b23e41ea0ac3e0b
SHA256

94b065f515d58a6179a81b48fb5fc2df015871adc96f100cae29678ecdd83e0e
SHA512

61c9e222e425c9f3850fbb0393aad746b64fd99c9802f6ef8d9be946bb76eac73d49741779a40fd6ee532b5c9f54deb2e32123bfe2c681892fca9e1b752d4bd5
SSDEEP

1536:REB+aic5Y6G245aQ3rubcCJSZ+0oD8LbmvakxqcuUukiPMH50DcfscZ:G+aJ26GL7uGiQHmS7cuDHMH504scZ

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}	96e9acdff141d9c52f5c5172e76f2748.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}\StubPath = "C:\\Program Files\\DBS.EXE"	96e9acdff141d9c52f5c5172e76f2748.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}\StubPath = "C:\\Program Files\\DBS.EXE"	userinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}	userinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{21E9C5D3-EBFF-11CD-B6FD-00AA00B4E22A}\StubPath = "C:\\Program Files\\DBS.EXE"	userinit.exe

Deletes itself 1 IoCs

pid	Process
1200	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2420	DBS.EXE
2692	DBS.EXE
2264	DBS.EXE

Loads dropped DLL 6 IoCs

pid	Process
2156	96e9acdff141d9c52f5c5172e76f2748.exe
2156	96e9acdff141d9c52f5c5172e76f2748.exe
1612	userinit.exe
1612	userinit.exe
2768	userinit.exe
2768	userinit.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 1612	2420	DBS.EXE	29
PID 2692 set thread context of 2768	2692	DBS.EXE	33
PID 2264 set thread context of 2800	2264	DBS.EXE	37

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DBS.EXE	96e9acdff141d9c52f5c5172e76f2748.exe
File created	C:\Program Files\DBS.EXE	96e9acdff141d9c52f5c5172e76f2748.exe
File opened for modification	C:\Program Files\DBS.EXE	userinit.exe
File created	C:\Program Files\DBS.EXE	userinit.exe
File opened for modification	C:\Program Files\DBS.EXE	userinit.exe
File created	C:\Program Files\DBS.EXE	userinit.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2420	2156	96e9acdff141d9c52f5c5172e76f2748.exe	28
PID 2156 wrote to memory of 2420	2156	96e9acdff141d9c52f5c5172e76f2748.exe	28
PID 2156 wrote to memory of 2420	2156	96e9acdff141d9c52f5c5172e76f2748.exe	28
PID 2156 wrote to memory of 2420	2156	96e9acdff141d9c52f5c5172e76f2748.exe	28
PID 2420 wrote to memory of 1612	2420	DBS.EXE	29
PID 2420 wrote to memory of 1612	2420	DBS.EXE	29
PID 2420 wrote to memory of 1612	2420	DBS.EXE	29
PID 2420 wrote to memory of 1612	2420	DBS.EXE	29
PID 2420 wrote to memory of 1612	2420	DBS.EXE	29
PID 2420 wrote to memory of 1612	2420	DBS.EXE	29
PID 2156 wrote to memory of 1200	2156	96e9acdff141d9c52f5c5172e76f2748.exe	30
PID 2156 wrote to memory of 1200	2156	96e9acdff141d9c52f5c5172e76f2748.exe	30
PID 2156 wrote to memory of 1200	2156	96e9acdff141d9c52f5c5172e76f2748.exe	30
PID 2156 wrote to memory of 1200	2156	96e9acdff141d9c52f5c5172e76f2748.exe	30
PID 1612 wrote to memory of 2692	1612	userinit.exe	32
PID 1612 wrote to memory of 2692	1612	userinit.exe	32
PID 1612 wrote to memory of 2692	1612	userinit.exe	32
PID 1612 wrote to memory of 2692	1612	userinit.exe	32
PID 2692 wrote to memory of 2768	2692	DBS.EXE	33
PID 2692 wrote to memory of 2768	2692	DBS.EXE	33
PID 2692 wrote to memory of 2768	2692	DBS.EXE	33
PID 2692 wrote to memory of 2768	2692	DBS.EXE	33
PID 2692 wrote to memory of 2768	2692	DBS.EXE	33
PID 2692 wrote to memory of 2768	2692	DBS.EXE	33
PID 1612 wrote to memory of 2772	1612	userinit.exe	34
PID 1612 wrote to memory of 2772	1612	userinit.exe	34
PID 1612 wrote to memory of 2772	1612	userinit.exe	34
PID 1612 wrote to memory of 2772	1612	userinit.exe	34
PID 2768 wrote to memory of 2264	2768	userinit.exe	36
PID 2768 wrote to memory of 2264	2768	userinit.exe	36
PID 2768 wrote to memory of 2264	2768	userinit.exe	36
PID 2768 wrote to memory of 2264	2768	userinit.exe	36
PID 2264 wrote to memory of 2800	2264	DBS.EXE	37
PID 2264 wrote to memory of 2800	2264	DBS.EXE	37
PID 2264 wrote to memory of 2800	2264	DBS.EXE	37
PID 2264 wrote to memory of 2800	2264	DBS.EXE	37
PID 2264 wrote to memory of 2800	2264	DBS.EXE	37
PID 2264 wrote to memory of 2800	2264	DBS.EXE	37
PID 2768 wrote to memory of 2956	2768	userinit.exe	38
PID 2768 wrote to memory of 2956	2768	userinit.exe	38
PID 2768 wrote to memory of 2956	2768	userinit.exe	38
PID 2768 wrote to memory of 2956	2768	userinit.exe	38

C:\Users\Admin\AppData\Local\Temp\96e9acdff141d9c52f5c5172e76f2748.exe
"C:\Users\Admin\AppData\Local\Temp\96e9acdff141d9c52f5c5172e76f2748.exe"
1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files\DBS.EXE
  "C:\Program Files\DBS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\SYSTEM32\userinit.exe
    3⤵
    - Modifies Installed Components in the registry
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Program Files\DBS.EXE
      "C:\Program Files\DBS.EXE"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\userinit.exe
        
        C:\Windows\SYSTEM32\userinit.exe
        5⤵
        Modifies Installed Components in the registry
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Program Files\DBS.EXE
        
        "C:\Program Files\DBS.EXE"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\userinit.exe
        
        C:\Windows\SYSTEM32\userinit.exe
        7⤵
        
        PID:2800
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c del "C:\Windows\SysWOW64\userinit.exe"
        6⤵
        
        PID:2956
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Windows\SysWOW64\userinit.exe"
      4⤵
      PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\96e9acdff141d9c52f5c5172e76f2748.exe"
  2⤵
  - Deletes itself
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\DBS.EXE

Filesize
134KB

MD5
96e9acdff141d9c52f5c5172e76f2748

SHA1
0945c9866bf02970c988b4279b23e41ea0ac3e0b

SHA256
94b065f515d58a6179a81b48fb5fc2df015871adc96f100cae29678ecdd83e0e

SHA512
61c9e222e425c9f3850fbb0393aad746b64fd99c9802f6ef8d9be946bb76eac73d49741779a40fd6ee532b5c9f54deb2e32123bfe2c681892fca9e1b752d4bd5

Download Submit
memory/1612-16-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1612-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1612-13-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1612-14-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1612-15-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1612-9-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/1612-26-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2768-27-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2768-31-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2768-39-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/2800-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2800-40-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads