e87f41b7c842149005448e3609de651aefabe4e67a6790a5de903c8b658bf80b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e87f41b7c842149005448e3609de651aefabe4e67a6790a5de903c8b658bf80b.exe
Size

155KB
MD5

f33925581e27ad82791c1f7d4b868050
SHA1

11d476f96efec8e8dd060c9a1d911c4c9601e9fd
SHA256

e87f41b7c842149005448e3609de651aefabe4e67a6790a5de903c8b658bf80b
SHA512

f1d850c2bef289985aea11da12120648b315f66ea4eaed1c17f1fe1387599241ad337c44e50fbb755d6436bae6e15706c1f7e97af63365f7515b0a05af964d2d
SSDEEP

3072:zoY0ALG7F60AM6r61ZNSaPK8bbuVSQJ0uOUR5Y7DFavjBoocB:0Y0ALG7HAMt1ZEs+NJ0rMYXwevB

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
1948	ktyqhhb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ktyqhhb.exe	e87f41b7c842149005448e3609de651aefabe4e67a6790a5de903c8b658bf80b.exe
File created	C:\PROGRA~3\Mozilla\ixnvdrc.dll	ktyqhhb.exe

C:\Users\Admin\AppData\Local\Temp\e87f41b7c842149005448e3609de651aefabe4e67a6790a5de903c8b658bf80b.exe
"C:\Users\Admin\AppData\Local\Temp\e87f41b7c842149005448e3609de651aefabe4e67a6790a5de903c8b658bf80b.exe"
1⤵
- Drops file in Program Files directory
PID:4032

C:\PROGRA~3\Mozilla\ktyqhhb.exe
C:\PROGRA~3\Mozilla\ktyqhhb.exe -arwhcpc
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\ktyqhhb.exe

Filesize
155KB

MD5
b9891de8c236d7e1563f6dfa8c4a966a

SHA1
9a295fd2398ba75389f34a7b9b39b1ba9ee5caf3

SHA256
a8ccea5f9c8e167ffacc666fc94574ee9b34c881380ca64ebf93a4d497aa7192

SHA512
5ec4e65c2645e0a4ac639caea5d1cfca1ffd239d6d2f118c2e1cf5fc286cbede203f08838aebd2c533282a6cc827352193433895841dfb0f007ff5668d6fea6e

Download Submit
memory/1948-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1948-11-0x0000000000580000-0x00000000005DB000-memory.dmp

Filesize
364KB

Download
memory/1948-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4032-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4032-1-0x00000000008F0000-0x000000000094B000-memory.dmp

Filesize
364KB

Download
memory/4032-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download