1815df2402a9fd0388c8e6f633d50f05ae0614337311c3d7d6a4bf052e903adc

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b455e96c363ef74667a35263e1fdfa90.exe
Size

82KB
MD5

b455e96c363ef74667a35263e1fdfa90
SHA1

bc36f6f034bbc50c9c119ff2de938c1a98d4bebc
SHA256

1815df2402a9fd0388c8e6f633d50f05ae0614337311c3d7d6a4bf052e903adc
SHA512

7b38a07d79be0e1fe3790de419c9aa0de7dc93d394281351b898f99f65cb46556f01bb196de22344111b0b9ee5a873bd422a6a0a8da3d96bda89b625f991f93f
SSDEEP

768:cvQ5qDLHRdw2iPSMEk/6KMvu571xuEMs96cyX1869bYpYyTSY/YjvK0fdeeeD11y:cvQoLHjw2iWPKMvw71sMLyXuHr0Veee2

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1172	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2476	rwmhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\rwmhost.exe	b455e96c363ef74667a35263e1fdfa90.exe
File created	C:\Windows\Debug\rwmhost.exe	b455e96c363ef74667a35263e1fdfa90.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2128	b455e96c363ef74667a35263e1fdfa90.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1172	2128	b455e96c363ef74667a35263e1fdfa90.exe	29
PID 2128 wrote to memory of 1172	2128	b455e96c363ef74667a35263e1fdfa90.exe	29
PID 2128 wrote to memory of 1172	2128	b455e96c363ef74667a35263e1fdfa90.exe	29
PID 2128 wrote to memory of 1172	2128	b455e96c363ef74667a35263e1fdfa90.exe	29

C:\Users\Admin\AppData\Local\Temp\b455e96c363ef74667a35263e1fdfa90.exe
"C:\Users\Admin\AppData\Local\Temp\b455e96c363ef74667a35263e1fdfa90.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B455E9~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1172

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\rwmhost.exe

Filesize
82KB

MD5
abcffeacd9a38d7e5810ca4344bd3c70

SHA1
3ccc17114bec40023fcd533d5784f6765ff4f9ad

SHA256
4ca7af91ad0d3dc007b1e10c45d524929806a577674ea8da89d1188cc12122f3

SHA512
c3890627c38b7131e664fe30ec1c6f61012550af8bdb9dceb7c2ff9c04921bf0b3b66b36e59371cc54e4acafc954d4ec074e8096c6d5487dfec4530337026f30

Download Submit