78ca0b6d788e8e784e8dd5ab11a57020fa89ed848ea1fb030206f0852811240b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4e4a2103c84663848ec52f21ab4c782.exe
Size

12KB
MD5

c4e4a2103c84663848ec52f21ab4c782
SHA1

885803962d3e50b2910c4c0e7667319d9bdd042b
SHA256

78ca0b6d788e8e784e8dd5ab11a57020fa89ed848ea1fb030206f0852811240b
SHA512

1d18ff1caa1395a5c14e2e29454939b7b9875dc48784ec97ada9a14af942b5f82842274f75bacbf336299cbeb409aa1c2af94faa7256e5de04fdb4aaab0a862d
SSDEEP

384:gaPxEH4r6x07XO/3/7C4HC6mKAVm56hFIOmp:HZ/WOLO/P7dHCGAVw

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
1684	ringttek.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4780-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x00070000000231f6-4.dat	upx
behavioral2/memory/4780-6-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/1684-7-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ringtte.dll	c4e4a2103c84663848ec52f21ab4c782.exe
File created	C:\Windows\SysWOW64\ringttek.exe	c4e4a2103c84663848ec52f21ab4c782.exe
File opened for modification	C:\Windows\SysWOW64\ringttek.exe	c4e4a2103c84663848ec52f21ab4c782.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1684	4780	c4e4a2103c84663848ec52f21ab4c782.exe	89
PID 4780 wrote to memory of 1684	4780	c4e4a2103c84663848ec52f21ab4c782.exe	89
PID 4780 wrote to memory of 1684	4780	c4e4a2103c84663848ec52f21ab4c782.exe	89
PID 4780 wrote to memory of 3476	4780	c4e4a2103c84663848ec52f21ab4c782.exe	103
PID 4780 wrote to memory of 3476	4780	c4e4a2103c84663848ec52f21ab4c782.exe	103
PID 4780 wrote to memory of 3476	4780	c4e4a2103c84663848ec52f21ab4c782.exe	103

C:\Users\Admin\AppData\Local\Temp\c4e4a2103c84663848ec52f21ab4c782.exe
"C:\Users\Admin\AppData\Local\Temp\c4e4a2103c84663848ec52f21ab4c782.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\ringttek.exe
  C:\Windows\system32\ringttek.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\c4e4a2103c84663848ec52f21ab4c782.exe.bat
  2⤵
  PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c4e4a2103c84663848ec52f21ab4c782.exe.bat

Filesize
182B

MD5
0fcc42400d490774ed5b1bd9dce7e250

SHA1
fa5a1f2e724905c95dbbd266657313eb09fb11e4

SHA256
2389f143b57d74a2ad914288aff5b2a282c8588608f503b229e9d612d63356bb

SHA512
f99d339c3eb4c9160852746d7fb44ab26e9917e063733f2e87711cb14c5bcab8625330fa89fc1c8985a7f0a422008c07acdc430a42ae5ea80190c5638c4ca34c

Download Submit
C:\Windows\SysWOW64\ringttek.exe

Filesize
12KB

MD5
c4e4a2103c84663848ec52f21ab4c782

SHA1
885803962d3e50b2910c4c0e7667319d9bdd042b

SHA256
78ca0b6d788e8e784e8dd5ab11a57020fa89ed848ea1fb030206f0852811240b

SHA512
1d18ff1caa1395a5c14e2e29454939b7b9875dc48784ec97ada9a14af942b5f82842274f75bacbf336299cbeb409aa1c2af94faa7256e5de04fdb4aaab0a862d

Download Submit
memory/1684-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4780-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4780-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download