c128930dfb22fef071cec7c4257db8aac4e29ca722eb3f376406bad76fc520f4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4096790bac2916ae132ae17b3beca8e.exe
Size

16KB
MD5

b4096790bac2916ae132ae17b3beca8e
SHA1

53e366717b1c3e6fddf3c02665a75c2ad16f53bd
SHA256

c128930dfb22fef071cec7c4257db8aac4e29ca722eb3f376406bad76fc520f4
SHA512

09d0c52476809c8a0e1152be7b847276fda74f4cda773a520f0142a371cc66a6c634e1a4f8688a1b186cb268259dddf0f1d7775017dd3d3d316bd51e792c88f5
SSDEEP

384:1iNl5Qy3+r2KcNmtLz2YEKSfUDPKuBMgAzIn9BZrfpyj:1yrOzUaLyYuAMUn9rf

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1076	b4096790bac2916ae132ae17b3beca8e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cmdbcs = "C:\\Windows\\cmdbcs.exe"	b4096790bac2916ae132ae17b3beca8e.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cmdbcs.dll	b4096790bac2916ae132ae17b3beca8e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\cmdbcs.exe	b4096790bac2916ae132ae17b3beca8e.exe
File opened for modification	C:\Windows\cmdbcs.exe	b4096790bac2916ae132ae17b3beca8e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1076	b4096790bac2916ae132ae17b3beca8e.exe
1076	b4096790bac2916ae132ae17b3beca8e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1076	b4096790bac2916ae132ae17b3beca8e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3460	1076	b4096790bac2916ae132ae17b3beca8e.exe	57
PID 1076 wrote to memory of 3460	1076	b4096790bac2916ae132ae17b3beca8e.exe	57

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Temp\b4096790bac2916ae132ae17b3beca8e.exe
  "C:\Users\Admin\AppData\Local\Temp\b4096790bac2916ae132ae17b3beca8e.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\cmdbcs.dll

Filesize
27KB

MD5
79bba3d8757557cfd525ac05d05252f6

SHA1
09a5e5b88d176f2a6a3e248312984cb2fb9f74ea

SHA256
c2a6e6715d3f0b6afa97799bae1c70b11509d51a54b53d2352b9378c254bea39

SHA512
061c7e6131f19ea804bbc12d8f88be7ad8fa39a1406d6cfd052ce37f64bdc248a42ca83f8859ea2d65e98957ff345c533d8c1c11976f3dbe3adb5366295eb2b8

Download Submit
memory/1076-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1076-6-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1076-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download