7bc98f29cd5046fc3a64fd187e2597215ccb71e843b891b7c0c4f2c666efe047

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b5965bf95cafef11e4a7691e48484c84.exe
Size

15KB
MD5

b5965bf95cafef11e4a7691e48484c84
SHA1

b0725d1e5890ec0bc4e4bfc2820c1ccfa8704eb4
SHA256

7bc98f29cd5046fc3a64fd187e2597215ccb71e843b891b7c0c4f2c666efe047
SHA512

3f5b20e7d456901d9727838634cc3f8b3589a6d748447a847d1b677ebc713ac055019af74e33ab0e26e21230c9029a51e320083ea764d2dd7d5795a89fbdc626
SSDEEP

384:+cqvk88Mje8s5dGxcvONP3+fwVc0wBzUFiX9rrk7:+cqlK86Mxcvq3+fcc5zUFiX9rrk7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\rasdlgcq.dll = "{00230023-0023-0023-0023-00230023BB15}"	b5965bf95cafef11e4a7691e48484c84.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	b5965bf95cafef11e4a7691e48484c84.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rasdlgcq.tmp	b5965bf95cafef11e4a7691e48484c84.exe
File opened for modification	C:\Windows\SysWOW64\rasdlgcq.tmp	b5965bf95cafef11e4a7691e48484c84.exe
File opened for modification	C:\Windows\SysWOW64\rasdlgcq.nls	b5965bf95cafef11e4a7691e48484c84.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00230023-0023-0023-0023-00230023BB15}	b5965bf95cafef11e4a7691e48484c84.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00230023-0023-0023-0023-00230023BB15}\InProcServer32	b5965bf95cafef11e4a7691e48484c84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00230023-0023-0023-0023-00230023BB15}\InProcServer32\ = "C:\\Windows\\SysWow64\\rasdlgcq.dll"	b5965bf95cafef11e4a7691e48484c84.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00230023-0023-0023-0023-00230023BB15}\InProcServer32\ThreadingModel = "Apartment"	b5965bf95cafef11e4a7691e48484c84.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	b5965bf95cafef11e4a7691e48484c84.exe
2492	b5965bf95cafef11e4a7691e48484c84.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	b5965bf95cafef11e4a7691e48484c84.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2152	2492	b5965bf95cafef11e4a7691e48484c84.exe	101
PID 2492 wrote to memory of 2152	2492	b5965bf95cafef11e4a7691e48484c84.exe	101
PID 2492 wrote to memory of 2152	2492	b5965bf95cafef11e4a7691e48484c84.exe	101

C:\Users\Admin\AppData\Local\Temp\b5965bf95cafef11e4a7691e48484c84.exe
"C:\Users\Admin\AppData\Local\Temp\b5965bf95cafef11e4a7691e48484c84.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\AE12.tmp.bat
  2⤵
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AE12.tmp.bat

Filesize
179B

MD5
3162544eddb442d35ae31c50988b1225

SHA1
2efe265d5ee97283ccc00442397c44756c1ec591

SHA256
25cc1e8a19748858622aa383c94b3b25e108f353371a7cf7a937153034ed6ed7

SHA512
0a4a0c0039f5ae3a4aabebf30f8032e825defe5ffd1305d2abf4647a789a87419e06d91f427d42fd1df61e18e991278510609c3bfeec5c9d513cd4c5a9b0bfa3

Download Submit
C:\Windows\SysWOW64\rasdlgcq.tmp

Filesize
701KB

MD5
ba131eae1b57300306abc4f03693c536

SHA1
cb8d54199285ecab5dd8d148b084f65bca464964

SHA256
a546c147a1d98f31739ca37c4adc7974b6a39c2a371ba9499b2bb03d7031ade5

SHA512
8e4ab016f7b050b6773100ab54aad3bac88283654324282e8fce8b77ad8f3aafd0e5361eaa47ace6c7775badccf9af54e93fc16d0ddfb4fa439ae11a9ea9ff60

Download Submit