1c38f3734fa38bff173deba60dc2b061462a0f30b79bca465c703efb20836632

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 00:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa91c6a8bd844e71f9597a470383b3ad.exe
Size

14KB
MD5

aa91c6a8bd844e71f9597a470383b3ad
SHA1

c97df0ffb42334ed36f4ebc502c094ac07132590
SHA256

1c38f3734fa38bff173deba60dc2b061462a0f30b79bca465c703efb20836632
SHA512

ab0baf08574ef6e7c0db180d5cf864aa8dcb87734247a0e05d00a566f9dba54570bfe7dd1dcad6f684ff8c3fb6b8397f43cd03f5e6b07b4a07d14caa5926acfc
SSDEEP

384:Ja3jSvKQM4EydAqO2K7gnXYz78vz+/87Uy1:JazSvKQM459K7gnMgrk4Uy1

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vnllmxxp.dll = "{DA56B183-A731-402b-9235-2CB8803E212D}"	aa91c6a8bd844e71f9597a470383b3ad.exe

Loads dropped DLL 1 IoCs

pid	Process
3384	aa91c6a8bd844e71f9597a470383b3ad.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vnllmxxp.tmp	aa91c6a8bd844e71f9597a470383b3ad.exe
File opened for modification	C:\Windows\SysWOW64\vnllmxxp.nls	aa91c6a8bd844e71f9597a470383b3ad.exe
File created	C:\Windows\SysWOW64\vnllmxxp.tmp	aa91c6a8bd844e71f9597a470383b3ad.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA56B183-A731-402b-9235-2CB8803E212D}\InProcServer32	aa91c6a8bd844e71f9597a470383b3ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA56B183-A731-402b-9235-2CB8803E212D}\InProcServer32\ = "C:\\Windows\\SysWow64\\vnllmxxp.dll"	aa91c6a8bd844e71f9597a470383b3ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA56B183-A731-402b-9235-2CB8803E212D}\InProcServer32\ThreadingModel = "Apartment"	aa91c6a8bd844e71f9597a470383b3ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DA56B183-A731-402b-9235-2CB8803E212D}	aa91c6a8bd844e71f9597a470383b3ad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3384	aa91c6a8bd844e71f9597a470383b3ad.exe
3384	aa91c6a8bd844e71f9597a470383b3ad.exe
3384	aa91c6a8bd844e71f9597a470383b3ad.exe
3384	aa91c6a8bd844e71f9597a470383b3ad.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3384	aa91c6a8bd844e71f9597a470383b3ad.exe
3384	aa91c6a8bd844e71f9597a470383b3ad.exe
3384	aa91c6a8bd844e71f9597a470383b3ad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2280	3384	aa91c6a8bd844e71f9597a470383b3ad.exe	92
PID 3384 wrote to memory of 2280	3384	aa91c6a8bd844e71f9597a470383b3ad.exe	92
PID 3384 wrote to memory of 2280	3384	aa91c6a8bd844e71f9597a470383b3ad.exe	92

C:\Users\Admin\AppData\Local\Temp\aa91c6a8bd844e71f9597a470383b3ad.exe
"C:\Users\Admin\AppData\Local\Temp\aa91c6a8bd844e71f9597a470383b3ad.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\E0DA.tmp.bat
  2⤵
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E0DA.tmp.bat

Filesize
179B

MD5
500e543f1a63d7770814f5307ecd4f91

SHA1
301f1869ebff09f6ae848ce96729a43c479d57ec

SHA256
a54ad6af2c48b64bee3ab1385dcdeaced296adcb989f97cfb2400bd4c868d1e1

SHA512
7434084c2a832b28a3a28210d220848dcbb4469717c03e44c63dc7dd28ba73d8112820adf35f4f0181877cf1e8ac9a7cc565d5dde8a27aaa637fa3baede8e27d

Download Submit
C:\Windows\SysWOW64\vnllmxxp.dll

Filesize
2.1MB

MD5
53efdafa69218323ee601a158e8f9c53

SHA1
2185c85ec02b05a6aedc7d5f35e0890586d741cc

SHA256
66eae92983ca4b26b8a98e06b4592e4cc9e67ef6e745214e8002addd2c118584

SHA512
070d253db1c8b390e787f8120f086abe49c47acacc2c9acd1b899d66398912ba671f4b447322260ff581c87bb1ace36d7808b6e20bb52d3d9608c8597b6e0619

Download Submit
C:\Windows\SysWOW64\vnllmxxp.tmp

Filesize
179KB

MD5
858d88b4215ed887a149d4157cf63f58

SHA1
94120f0982105f664bd8fa0a405f284575dbc299

SHA256
ad665cf51b6572523bc86a06492e2d5f71093850ed317db1742efc886b5d6e71

SHA512
a9d818eafd597cce574913453d726845eb2e901251eaacbcbdb6e2b61873f63a99cd4964dbb6313d7aed3a65bf9f55e1926151fd81fa9ca32109248af7a192a4

Download Submit
memory/3384-13-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3384-18-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download