e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356

Analysis

max time kernel
106s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Size 74KB
Sample240311-bv9fjsgg83
SHA256 e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356
MD5 3cafcfe7027d1b6e062bb76c6f42da2d
SHA1 f7dde493d073bbc35a4d51cabc59393644c80fce
SHA512 4c0462317c451ded9290795c50f2cafe67d9a970aac0f68a494e3beaa8b236c956a122512631c454e11bced544159e96a5c0e8f72edc2428cead146ccbf402b3
SSDEEP 1536:wQAhDmLCyiYZi2o4NdqOAngwmJGRF6ZOJhTIpIAGp:fuDmLhi8i2ourZwmJGRF/TEVGp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njcpee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidbn32.exe

Executes dropped EXE 5 IoCs

pid	Process
224	Ncihikcg.exe
4328	Njcpee32.exe
540	Nnolfdcn.exe
4056	Ndidbn32.exe
4652	Nkcmohbg.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ncihikcg.exe	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
File created	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File opened for modification	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
File opened for modification	C:\Windows\SysWOW64\Njcpee32.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Njcpee32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Njcpee32.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
File created	C:\Windows\SysWOW64\Ddpfgd32.dll	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ndidbn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4012	4652	WerFault.exe	89

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkckjila.dll"	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ncihikcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njcpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknpkhch.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 224	5068	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe	85
PID 5068 wrote to memory of 224	5068	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe	85
PID 5068 wrote to memory of 224	5068	e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe	85
PID 224 wrote to memory of 4328	224	Ncihikcg.exe	86
PID 224 wrote to memory of 4328	224	Ncihikcg.exe	86
PID 224 wrote to memory of 4328	224	Ncihikcg.exe	86
PID 4328 wrote to memory of 540	4328	Njcpee32.exe	87
PID 4328 wrote to memory of 540	4328	Njcpee32.exe	87
PID 4328 wrote to memory of 540	4328	Njcpee32.exe	87
PID 540 wrote to memory of 4056	540	Nnolfdcn.exe	88
PID 540 wrote to memory of 4056	540	Nnolfdcn.exe	88
PID 540 wrote to memory of 4056	540	Nnolfdcn.exe	88
PID 4056 wrote to memory of 4652	4056	Ndidbn32.exe	89
PID 4056 wrote to memory of 4652	4056	Ndidbn32.exe	89
PID 4056 wrote to memory of 4652	4056	Ndidbn32.exe	89

C:\Users\Admin\AppData\Local\Temp\e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe
"C:\Users\Admin\AppData\Local\Temp\e47582e13a924b734620e415eb709996cff7548741d325d853db96f2c85c4356.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\Ncihikcg.exe
  C:\Windows\system32\Ncihikcg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\Njcpee32.exe
    C:\Windows\system32\Njcpee32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\Nnolfdcn.exe
      C:\Windows\system32\Nnolfdcn.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        6⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 412
        7⤵
        Program crash
        
        PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4652 -ip 4652
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hnibdpde.dll

Path C:\Windows\SysWOW64\Hnibdpde.dll
Size 7KB
SHA256 f45d90f4a74ff5c6be03c2e194f5600fca14e5a200d52fdf3d788e176658d0a7
MD5 3d92b9ec6235ddc198283475e9d00a10
SHA1 cd9fcf532dcc1226bafedf3a801a5bd294e1319e
SHA512 a08340b26a5682f32deee64c5ad29d255353b0d4dae09a52b26212bdfa7aafe69c646f56445a84b0c911fda685afe221acd993eb2ecb31a7ba36a126def3f00f
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPW7bABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPVq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ncihikcg.exe

Path C:\Windows\SysWOW64\Ncihikcg.exe
Size 74KB
SHA256 399bb1e927c176caeda9f835a9dee93557ce897953ca279b50635b9e05f28f63
MD5 3d7f9be6eb8b7311142b6032ed7957e3
SHA1 9250d4200577af16976647efea940826c3e9616b
SHA512 20b0d16f0981d3c3cf2eeae4cb8997094e224c92a66974f30acd1333d71a582899dc63deae78e1a8de2f5a3f5531f4f193f4af1c2b3fdf643127d35b29dd18b3
SSDEEP 1536:IgWIsUASyZxvHflligy+H5iOf6AGwm7V92iScrQi+7Fp:uwASyZNHfTigyAg7zfSgQR7Fp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 74KB
SHA256 f6e5aa752eca6b5feee3d003e1a064f4ac92abc431549b34ee51fd64f2b235b3
MD5 b1b1da90b33e90ac8fa34f3f45352530
SHA1 a44ee3375d8560e76340592ce45b904ec4d9eb68
SHA512 161e59cb1bc86f0388f6b7ac0da9d5f005b59b0853e8a81c3af118a9758eb371577d447a80cccfa15435f61a71101d802db9483e09c87e9cf2c7ba8bd965433e
SSDEEP 768:6mzUkb8Vyy6/OyJlS9y0u8mAJ1ozFE15bB8wf0QQMRq6y0rLdppX0HqQ9Av8Q5fp:FUa8Vm/OyJlSEwTo+Ows5wrLdnRQI9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Njcpee32.exe

Path C:\Windows\SysWOW64\Njcpee32.exe
Size 74KB
SHA256 e7b757a41d7602e4a16c171cbabc04ce5a0d1c3d4e63ce5650a15398f120d99b
MD5 0fec4edc404ca728aaa385a4a81d97d5
SHA1 a765c460931315e373507afb45fbbcd1f32a2235
SHA512 c34a3b6e8f7cf73f0bc4cc64c26f5d274d1608ecfa9e90ede1de17b8e55638743520af8354cadd707272ae9fbda06093474eb30bf18d340af957982d5d42d18b
SSDEEP 1536:33ISTseLLbbquiiDH/Ic4j3X7ctt59+jjh7P6gQNeRX6rNPzl1rrODOBA6lyaSu8:3YSTseLLbbJiiDp4zLctt5MjF7P6guMt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 74KB
SHA256 98bf7b55c2359edf3f1be7f5e36c3d6dd9e2d56f2887695e6824111ca338b42f
MD5 955ae67036b7c42707a54bd8089d1c43
SHA1 31c34e5bb480774973f47205df2faa747ec244d4
SHA512 ae22259a8ec20229cbdcea0a784c015a3b42ec43dc6bb0a8e356ddad0fc0eedadd7ead35fddc88e5879169bb1c403550d59e3e38beb0e80e4197b5b6ad693c7b
SSDEEP 1536:x9egcbtvr50zHQKe+5cT8/yq6Xro+x8LmR+rWfzrcYjlOHAhqm0NgyKrYp:x9eLt8k+5cJI+/rlv0iHYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnolfdcn.exe

Path C:\Windows\SysWOW64\Nnolfdcn.exe
Size 74KB
SHA256 dfa85d42b7772394e9a5a2c6f54ffc62929a063773473cbdf18f4ac393f735b9
MD5 e915a414ff7037e231b726fc3fc5de71
SHA1 53380cbf7f04a81a22e0548863d8d2b9e7b29a22
SHA512 21c2b5f99cb7c892c434d7dcfb4d228ba316401e101c6db0c731490adcc8b7218978f626d0e7ff870d11f01e9d4258006dba71dbbd88e342660cdb250d71d1aa
SSDEEP 768:M28P1AmZgIbdPn9P36fXp7sksoKnUtssSaRUrAcgR/dmy1p1uAV0S/83n0OFX3Ws:kaOpnYBAdUjxR1puc0l0Ox3N2i7WJSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/224-45-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/540-43-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4056-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4056-42-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4328-20-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4652-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4652-41-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5068-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5068-46-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads