ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe
Size

196KB
MD5

6446389cc678c52be134d6b651c7596b
SHA1

6d9c811c61399e974c4583e217a8a9d82056a4dc
SHA256

ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb
SHA512

575978df0950cee47faaf5fe4b185848bd057a8f90a2d0079518798ca3f9a6ed4c969e600b2b3100ddf5c970ec85db1ec6721544fcb6b15df5b7a6a039058e76
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOS:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXn

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2588	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2120	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rwmhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rwmhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2160	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2588	2160	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe	29
PID 2160 wrote to memory of 2588	2160	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe	29
PID 2160 wrote to memory of 2588	2160	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe	29
PID 2160 wrote to memory of 2588	2160	ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe	29

C:\Users\Admin\AppData\Local\Temp\ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe
"C:\Users\Admin\AppData\Local\Temp\ed48aac3d2ef5759f15193411624fa22a6288b20afee6d39a5f510ef4ee8aabb.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ED48AA~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2588

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\rwmhost.exe

Filesize
196KB

MD5
148ed42519c806fd57b9dec9656b8bf9

SHA1
7e7d2faac28f1287685e4dfb675f34c7dab0e574

SHA256
1f75e4fca5456302bc6ebaf2614101342eec66eb23d9fc2f3ee4151936a61780

SHA512
aa843fa9cca319fc2909a51453661aec62184e6eb455214736ff3ccad233ffef659dcc582dd9b53ed957b68a8bf774253bcb6177ed52241086a0a786bed2335f

Download Submit