Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 21:58
Static task
static1
Behavioral task
behavioral1
Sample
c9b6b9bfa26a7e9b2950f3e30820069d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c9b6b9bfa26a7e9b2950f3e30820069d.exe
Resource
win10v2004-20240226-en
General
-
Target
c9b6b9bfa26a7e9b2950f3e30820069d.exe
-
Size
407KB
-
MD5
c9b6b9bfa26a7e9b2950f3e30820069d
-
SHA1
282b807d3a7adb05dfb527d5e7db0ee81f36167a
-
SHA256
8061cf54b5728fc8eea005c8f5214dccc50f5417ac3d4b17de87aeec8c4ba255
-
SHA512
1bfc76f7ec30162e5d015fec96f27ac55d19f0370fa62d07b58b7cb375ef1f7da82bc6ec448e1aac9ea524fd2b736e495bb166104a4498b4c1b24f4e8536fed6
-
SSDEEP
12288:Tg0Cq6x4aIhpJIew5rzWZfb6YkOVYGXKmRjVNL:TyfsJezoxkOVim
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c9b6b9bfa26a7e9b2950f3e30820069d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\ProgramData\\cE35400AaDkD35400\\cE35400AaDkD35400.exe" c9b6b9bfa26a7e9b2950f3e30820069d.exe -
Deletes itself 1 IoCs
Processes:
cE35400AaDkD35400.exepid process 1712 cE35400AaDkD35400.exe -
Executes dropped EXE 1 IoCs
Processes:
cE35400AaDkD35400.exepid process 1712 cE35400AaDkD35400.exe -
Loads dropped DLL 2 IoCs
Processes:
c9b6b9bfa26a7e9b2950f3e30820069d.exepid process 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe -
Processes:
resource yara_rule behavioral1/memory/2156-1-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2156-81-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2156-103-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/1712-105-0x0000000000400000-0x00000000004CC000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cE35400AaDkD35400.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\cE35400AaDkD35400 = "C:\\ProgramData\\cE35400AaDkD35400\\cE35400AaDkD35400.exe" cE35400AaDkD35400.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c9b6b9bfa26a7e9b2950f3e30820069d.exepid process 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c9b6b9bfa26a7e9b2950f3e30820069d.execE35400AaDkD35400.exedescription pid process Token: SeDebugPrivilege 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe Token: SeDebugPrivilege 1712 cE35400AaDkD35400.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c9b6b9bfa26a7e9b2950f3e30820069d.exedescription pid process target process PID 2156 wrote to memory of 1712 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe cE35400AaDkD35400.exe PID 2156 wrote to memory of 1712 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe cE35400AaDkD35400.exe PID 2156 wrote to memory of 1712 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe cE35400AaDkD35400.exe PID 2156 wrote to memory of 1712 2156 c9b6b9bfa26a7e9b2950f3e30820069d.exe cE35400AaDkD35400.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9b6b9bfa26a7e9b2950f3e30820069d.exe"C:\Users\Admin\AppData\Local\Temp\c9b6b9bfa26a7e9b2950f3e30820069d.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cE35400AaDkD35400\cE35400AaDkD35400.exe"C:\ProgramData\cE35400AaDkD35400\cE35400AaDkD35400.exe" "C:\Users\Admin\AppData\Local\Temp\c9b6b9bfa26a7e9b2950f3e30820069d.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\cE35400AaDkD35400\cE35400AaDkD35400Filesize
208B
MD5a7a634cf2a7bb64352b9e642ee8003fe
SHA13eca7fcde259b3ad6a424dfc625e4d7ff55b1a96
SHA256c6170e8556b4a3fbf8d24554bb6051e8023fcba7b083dfd1cf923d2052308653
SHA512ac7ce005c6f2a5101a504ef95fe08ff1874c242fd0f1ad86d9c920cd15f06f7ce79dc099a7c72ca944a7d693d4bb17804ee4801aed866b1681b76d4643cb9f50
-
C:\ProgramData\cE35400AaDkD35400\cE35400AaDkD35400.exeFilesize
407KB
MD517177f89ae8a0cefa754c416c91cf3bd
SHA1dcf692126729ad0c6fa03fbe4f555d5d49751b3d
SHA2563d222c5b96b7c5ee020c72226bf851d0352413558935e1a4fa6b592fd3ec36f1
SHA5120aee74e3dd6d573d8c7aa248ae87555e34a81d3d657aa3e5e17dc97269301995427c7082fa45cf1a5342af9399a030780e7dab9b02c5a601a3a6a94e77850d1d
-
memory/1712-105-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/1712-106-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-0-0x00000000002D0000-0x00000000002D3000-memory.dmpFilesize
12KB
-
memory/2156-1-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/2156-2-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/2156-81-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/2156-103-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB