6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a.exe
Size

215KB
MD5

46e1e1891a90c047a2bf4c69014cfed5
SHA1

4eb6edccc11e495db777c71aa965e08a667d98a1
SHA256

6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a
SHA512

81570d9586862b6ef0850ca96f4496dd682eb979b962b9989f61f356ba84f87cbf57e9130808647c74e1bcfbdd4b8b1678dd2defd28243f7dda5392b4c087d94
SSDEEP

3072:kBxSp4183Sf3/pFSh+xvPPMmuncWbWesx7GrYHrnu33KF:B4/cHmunIhdGsHrn2KF

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2252	racmzae.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\racmzae.exe	6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a.exe
File created	C:\PROGRA~3\Mozilla\ttbtowf.dll	racmzae.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1756	6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a.exe
2252	racmzae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2252	2264	taskeng.exe	29
PID 2264 wrote to memory of 2252	2264	taskeng.exe	29
PID 2264 wrote to memory of 2252	2264	taskeng.exe	29
PID 2264 wrote to memory of 2252	2264	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a.exe
"C:\Users\Admin\AppData\Local\Temp\6cd16544366986221847d01174f5d300e08c958aa2139ed840a47d896ec2b60a.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1756

C:\Windows\system32\taskeng.exe
taskeng.exe {1E8874E6-9B86-44C0-A6C7-08AEC106BC21} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\PROGRA~3\Mozilla\racmzae.exe
  C:\PROGRA~3\Mozilla\racmzae.exe -cddhnyc
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\racmzae.exe

Filesize
215KB

MD5
a6126fe90e94e73aebcb6addab7a350e

SHA1
7238621d3caf31dc53f7abe1c9d5140ace9bd148

SHA256
4b152fbe7927ccb6ad8c87d36f453f1e00c4bfbe943eedca7cec0d413566b9a1

SHA512
da8a951b1ad2e19ecbd58d372a87baed72623b62567b14ceaee615086085606b4f6715eb4079efcd495e8575723476975b5be71acc83081eb669e5926418a958

Download Submit
memory/1756-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1756-1-0x00000000002E0000-0x000000000033B000-memory.dmp

Filesize
364KB

Download
memory/1756-0-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1756-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1756-5-0x00000000002E0000-0x000000000033B000-memory.dmp

Filesize
364KB

Download
memory/2252-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2252-9-0x0000000000880000-0x00000000008DB000-memory.dmp

Filesize
364KB

Download
memory/2252-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2252-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download