Analysis

  • max time kernel
    147s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 04:11

General

  • Target

    xiezai.exe

  • Size

    45KB

  • MD5

    6e4c948407b43e2bf15c9bbef5e2b35e

  • SHA1

    de139fe1114aeaf8064379afdeb32184cb852d32

  • SHA256

    8e76e356a9b92f70ed731d96eab90d59586a7e53d3c4bc6a50f1347546c2a992

  • SHA512

    471e204f9426fd9d250ba02b1b0f08add3cc22d31c718f43efe567987399a8858f7236672d94a7623a16b6b29a0cdd04bae6883c2c642a97ff188d8aac203db1

  • SSDEEP

    768:nvfkFhTjNfFgYkmQXyZxM5nndpvwSOy10DW4jM4gJZJ9DMBM3MJJmCB9asnRvOXW:vfkzTjNfFzfcPn7o/DW2M4gJFMJJmC1t

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xiezai.exe
    "C:\Users\Admin\AppData\Local\Temp\xiezai.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:3484

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsg7CF1.tmp\FindProcDLL.dll

          Filesize

          3KB

          MD5

          8614c450637267afacad1645e23ba24a

          SHA1

          e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

          SHA256

          0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

          SHA512

          af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

        • C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

          Filesize

          45KB

          MD5

          6e4c948407b43e2bf15c9bbef5e2b35e

          SHA1

          de139fe1114aeaf8064379afdeb32184cb852d32

          SHA256

          8e76e356a9b92f70ed731d96eab90d59586a7e53d3c4bc6a50f1347546c2a992

          SHA512

          471e204f9426fd9d250ba02b1b0f08add3cc22d31c718f43efe567987399a8858f7236672d94a7623a16b6b29a0cdd04bae6883c2c642a97ff188d8aac203db1

        • memory/3484-10-0x0000000010000000-0x0000000010003000-memory.dmp

          Filesize

          12KB