a703b317dc8a2e4f7955d9504865ad7537870bb294944afc668643603baf70ed

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c027e55b9a054379a5859837105dd0.exe
Size

13KB
MD5

d5c027e55b9a054379a5859837105dd0
SHA1

71698e9b27a20a67d32824e757f60f33dafecb4f
SHA256

a703b317dc8a2e4f7955d9504865ad7537870bb294944afc668643603baf70ed
SHA512

3af6b29d2517c52a338dc2ca08b358235017c447fe190a769efa49a64941f6c541d69a3a05b8a25ab61c6925b563b085f36dedf149f1d7d77b1c34c417c44d49
SSDEEP

384:xTsZocy8CY1iRzDK7BF5b3JFmqpTmfi2Kl8jV6M+:xwZoh8zazDK7BPldT6iSV+

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	ravdh3mon.exe

Loads dropped DLL 2 IoCs

pid	Process
1460	d5c027e55b9a054379a5859837105dd0.exe
1460	d5c027e55b9a054379a5859837105dd0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ravdh3mon = "C:\\Program Files\\NetMeeting\\ravdh3mon.exe"	ravdh3mon.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\NetMeeting\ravdh3mon.exe	d5c027e55b9a054379a5859837105dd0.exe
File created	C:\Program Files\NetMeeting\ravdh3mon.exe	d5c027e55b9a054379a5859837105dd0.exe
File opened for modification	C:\Program Files\NetMeeting\ravdh3mon.cfg	d5c027e55b9a054379a5859837105dd0.exe
File opened for modification	C:\Program Files\NetMeeting\ravdh3mon.dat	ravdh3mon.exe
File created	C:\Program Files\NetMeeting\ravdh3mon.dat	ravdh3mon.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1460	d5c027e55b9a054379a5859837105dd0.exe
1460	d5c027e55b9a054379a5859837105dd0.exe
2692	ravdh3mon.exe
2692	ravdh3mon.exe
2692	ravdh3mon.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	ravdh3mon.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2692	1460	d5c027e55b9a054379a5859837105dd0.exe	28
PID 1460 wrote to memory of 2692	1460	d5c027e55b9a054379a5859837105dd0.exe	28
PID 1460 wrote to memory of 2692	1460	d5c027e55b9a054379a5859837105dd0.exe	28
PID 1460 wrote to memory of 2692	1460	d5c027e55b9a054379a5859837105dd0.exe	28
PID 2692 wrote to memory of 1228	2692	ravdh3mon.exe	21
PID 1460 wrote to memory of 2580	1460	d5c027e55b9a054379a5859837105dd0.exe	29
PID 1460 wrote to memory of 2580	1460	d5c027e55b9a054379a5859837105dd0.exe	29
PID 1460 wrote to memory of 2580	1460	d5c027e55b9a054379a5859837105dd0.exe	29
PID 1460 wrote to memory of 2580	1460	d5c027e55b9a054379a5859837105dd0.exe	29

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228
- C:\Users\Admin\AppData\Local\Temp\d5c027e55b9a054379a5859837105dd0.exe
  "C:\Users\Admin\AppData\Local\Temp\d5c027e55b9a054379a5859837105dd0.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files\NetMeeting\ravdh3mon.exe
    "C:\Program Files\NetMeeting\ravdh3mon.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\d5c027e55b9a054379a5859837105dd0.exe"
    3⤵
    - Deletes itself
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\NetMeeting\ravdh3mon.exe

Filesize
13KB

MD5
d5c027e55b9a054379a5859837105dd0

SHA1
71698e9b27a20a67d32824e757f60f33dafecb4f

SHA256
a703b317dc8a2e4f7955d9504865ad7537870bb294944afc668643603baf70ed

SHA512
3af6b29d2517c52a338dc2ca08b358235017c447fe190a769efa49a64941f6c541d69a3a05b8a25ab61c6925b563b085f36dedf149f1d7d77b1c34c417c44d49

Download Submit
memory/1228-16-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download