b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
Size

683KB
MD5

b0e4c2172afcdb89e7cb65ad3dfb7145
SHA1

19580c0f3b97602d93094fd1eb8fd27579e9d17e
SHA256

b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a
SHA512

c4c6e3e3999ec7780696a22066906ac7b672136f480502a64c955098024620d1e694b9018377521780c668cf26c2dc36f4e82fc8ee808f1432c37938c2c7c93a
SSDEEP

12288:PK5yuMYwM2t2t14FNHXsE59stFbfw7V3+HlLwxOiMCyINCK:C5XMYwM2t20p8E5ObSuHlLhlIkK

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder1\\Semibaldness.exe"	wab.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\devastate.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
2084	wab.exe
2084	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
2084	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2876 set thread context of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\duodecimos.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
File opened for modification	C:\Program Files (x86)\hamus.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Forglemmes130\coatee.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
File opened for modification	C:\Windows\resources\0409\folders\Sequenser.ini	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2084	wab.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30
PID 2876 wrote to memory of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30
PID 2876 wrote to memory of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30
PID 2876 wrote to memory of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30
PID 2876 wrote to memory of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30
PID 2876 wrote to memory of 2084	2876	b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe	30

C:\Users\Admin\AppData\Local\Temp\b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe
"C:\Users\Admin\AppData\Local\Temp\b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\windows mail\wab.exe
  "C:\Users\Admin\AppData\Local\Temp\b6ec88e783ae2ca38088944f15063c6c9dcdd7954de8227f3c724e860e87437a.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Smklaasens.lnk

Filesize
1KB

MD5
c10cc977cd32c75d9b5d73ba61461f42

SHA1
bd88a0ceb8bf7f7837f326e3eefe4701b5521f81

SHA256
ebc430fcd06d8b594ae397f9b009ddfe91c71af1ebae1775f9b399621cd9e4eb

SHA512
872a1b9604dd9d0d70121570f65f70a5b4a972b494600bb66ef422282d2e0b854cdc67eda6d95e4f360eb7238274e486d350024f724b48013ed9a79f46d13ab6

Download Submit
\Users\Admin\AppData\Local\Temp\nso65F5.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
memory/2084-263-0x0000000077A50000-0x0000000077BF9000-memory.dmp

Filesize
1.7MB

Download
memory/2084-264-0x0000000077C76000-0x0000000077C77000-memory.dmp

Filesize
4KB

Download
memory/2084-265-0x0000000077C40000-0x0000000077D16000-memory.dmp

Filesize
856KB

Download
memory/2084-267-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-269-0x0000000077C40000-0x0000000077D16000-memory.dmp

Filesize
856KB

Download
memory/2084-270-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-271-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-272-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-268-0x0000000001B00000-0x0000000007464000-memory.dmp

Filesize
89.4MB

Download
memory/2084-273-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-274-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-275-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-276-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-277-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-278-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-279-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-280-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-281-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-283-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-284-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-285-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-286-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-287-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-288-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-291-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-292-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-293-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-294-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-295-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-296-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-297-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-298-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-299-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-301-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-302-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-303-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-304-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-305-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-306-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-307-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-308-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-309-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-310-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-311-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-312-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-313-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-314-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-315-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-316-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-317-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-319-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-320-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-321-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-322-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-323-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-324-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-325-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-326-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-327-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-328-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-329-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-330-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2084-332-0x0000000000A90000-0x0000000001AF2000-memory.dmp

Filesize
16.4MB

Download
memory/2876-261-0x0000000077C40000-0x0000000077D16000-memory.dmp

Filesize
856KB

Download
memory/2876-260-0x0000000077A50000-0x0000000077BF9000-memory.dmp

Filesize
1.7MB

Download
memory/2876-262-0x0000000010000000-0x0000000010006000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads