cbc5bd1d308bcc580da09096468b019fe0a064f91f1c512071ee67748195a82b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e005ce57821d20bee59978a6a4bd0f8d.exe
Size

14KB
MD5

e005ce57821d20bee59978a6a4bd0f8d
SHA1

3e8422dc4b40436d78c093f8d7fb3c03792ecee5
SHA256

cbc5bd1d308bcc580da09096468b019fe0a064f91f1c512071ee67748195a82b
SHA512

b4655a64ab8db8b9f5a5198c57be67eeb722602d6797d24ceef585c92dad0569035e2abc4ee29f9f7da3fd35ea5ff6027437c21bbd4b6896eb0a266cfdd305a6
SSDEEP

384:kKtBT+TlFk7akcmfc9+Ces4BpbdODyeAoZS+Kr:kgBqhFkFcmUH2bA8o2

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\priqmtxm.dll = "{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}"	e005ce57821d20bee59978a6a4bd0f8d.exe

Deletes itself 1 IoCs

pid	Process
2492	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3004	e005ce57821d20bee59978a6a4bd0f8d.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\priqmtxm.tmp	e005ce57821d20bee59978a6a4bd0f8d.exe
File opened for modification	C:\Windows\SysWOW64\priqmtxm.tmp	e005ce57821d20bee59978a6a4bd0f8d.exe
File opened for modification	C:\Windows\SysWOW64\priqmtxm.nls	e005ce57821d20bee59978a6a4bd0f8d.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}	e005ce57821d20bee59978a6a4bd0f8d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}\InProcServer32	e005ce57821d20bee59978a6a4bd0f8d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}\InProcServer32\ = "C:\\Windows\\SysWow64\\priqmtxm.dll"	e005ce57821d20bee59978a6a4bd0f8d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}\InProcServer32\ThreadingModel = "Apartment"	e005ce57821d20bee59978a6a4bd0f8d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3004	e005ce57821d20bee59978a6a4bd0f8d.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3004	e005ce57821d20bee59978a6a4bd0f8d.exe
3004	e005ce57821d20bee59978a6a4bd0f8d.exe
3004	e005ce57821d20bee59978a6a4bd0f8d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2492	3004	e005ce57821d20bee59978a6a4bd0f8d.exe	30
PID 3004 wrote to memory of 2492	3004	e005ce57821d20bee59978a6a4bd0f8d.exe	30
PID 3004 wrote to memory of 2492	3004	e005ce57821d20bee59978a6a4bd0f8d.exe	30
PID 3004 wrote to memory of 2492	3004	e005ce57821d20bee59978a6a4bd0f8d.exe	30

C:\Users\Admin\AppData\Local\Temp\e005ce57821d20bee59978a6a4bd0f8d.exe
"C:\Users\Admin\AppData\Local\Temp\e005ce57821d20bee59978a6a4bd0f8d.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\D7A9.tmp.bat
  2⤵
  - Deletes itself
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D7A9.tmp.bat

Filesize
179B

MD5
fd258aae2b3ccb53a8c2e6998cbba3ac

SHA1
b9a88f29d1d28137ab9901c7de2914af6253a926

SHA256
b75b417f3923fa26134a744cb01f586a2127b2e77fbfd942f9c088f9d3ff2bbe

SHA512
6cf6ea7fa73b25a974ef2c9dc8618a5d870657a787600676e0553890ed0ba98efc6738bfe52e467a0383b8cc79b2c1785dcd7b68972040c53b3b811c223c2272

Download Submit
C:\Windows\SysWOW64\priqmtxm.tmp

Filesize
588KB

MD5
d92f8f16ecd3ee885dbc1a043e7b6cb3

SHA1
749767f0ba753118a4be21d7831ea7026e9dbc03

SHA256
37fb296b33209c83304fd2ec2758cf6282f7c7d18fa673367cc187dfa84d2ce3

SHA512
b1f3f58d503ce607f0885f56a161583761de4d72b87820fab83b19445b9446b0d9b3d12b314134462aac49f82b3f3102f2bd6378d9fe74ab7d0a158af524f70b

Download Submit
memory/3004-12-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download
memory/3004-21-0x0000000020000000-0x0000000020008000-memory.dmp

Filesize
32KB

Download