Analysis
-
max time kernel
42s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2024, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
Resource
win11-20240221-en
General
-
Target
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
-
Size
5.6MB
-
MD5
731812403191b60503e017d88e23b1a3
-
SHA1
67e1c24ded75620181916dea9654eeddf4049525
-
SHA256
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2
-
SHA512
1ae78e7d5e134d56ebbe9ec3e71bd7529aedbe5670a93b7728eca0aa482ac6688187884c5a61c2c8ef308acda555152d4d5cd2938d1cfa57303a8649803f01d5
-
SSDEEP
98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6m:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciK
Malware Config
Signatures
-
MilleniumRat
MilleniumRat is a remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation Update.exe -
Executes dropped EXE 1 IoCs
pid Process 1056 Update.exe -
Loads dropped DLL 2 IoCs
pid Process 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 1056 Update.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 17 raw.githubusercontent.com 36 raw.githubusercontent.com 14 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 1100 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3648 tasklist.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1636 reg.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe 1056 Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe Token: SeDebugPrivilege 3648 tasklist.exe Token: SeDebugPrivilege 1056 Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1056 Update.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3492 wrote to memory of 2532 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 92 PID 3492 wrote to memory of 2532 3492 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe 92 PID 2532 wrote to memory of 3648 2532 cmd.exe 94 PID 2532 wrote to memory of 3648 2532 cmd.exe 94 PID 2532 wrote to memory of 4628 2532 cmd.exe 95 PID 2532 wrote to memory of 4628 2532 cmd.exe 95 PID 2532 wrote to memory of 1100 2532 cmd.exe 96 PID 2532 wrote to memory of 1100 2532 cmd.exe 96 PID 2532 wrote to memory of 1056 2532 cmd.exe 97 PID 2532 wrote to memory of 1056 2532 cmd.exe 97 PID 1056 wrote to memory of 2024 1056 Update.exe 98 PID 1056 wrote to memory of 2024 1056 Update.exe 98 PID 2024 wrote to memory of 1636 2024 cmd.exe 100 PID 2024 wrote to memory of 1636 2024 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe"C:\Users\Admin\AppData\Local\Temp\db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp5757.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp5757.tmp.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 3492"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\system32\find.exefind ":"3⤵PID:4628
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak3⤵
- Delays execution with timeout.exe
PID:1100
-
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f4⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f5⤵
- Adds Run key to start application
- Modifies registry key
PID:1636
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
-
Filesize
256B
MD5841d3c6730065dccef5c56e09419781f
SHA1ed4170eed37c8f70e38877ad440887d83f0d3168
SHA256ab431c14fc1d077217a8795a80ea9c3f21aaf3ed0e53aaad37b3910443b00cd8
SHA51214684650c57bc2cb2765844a1f22beaa2ad0843afc790e17932a26692b0710d1833cadb0f26934b64d4aceeb87bcd89727becc59c4c44e9f97db2fd2e19983fa
-
Filesize
5.6MB
MD5731812403191b60503e017d88e23b1a3
SHA167e1c24ded75620181916dea9654eeddf4049525
SHA256db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2
SHA5121ae78e7d5e134d56ebbe9ec3e71bd7529aedbe5670a93b7728eca0aa482ac6688187884c5a61c2c8ef308acda555152d4d5cd2938d1cfa57303a8649803f01d5