a2d53a525fa5c5c77a38ba9c7a1a759267e313aca806d064570fc068e913cf45

Analysis

max time kernel
137s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e23aafbe57a58f302b4f6ee19ce5fcce.exe
Size

19KB
MD5

e23aafbe57a58f302b4f6ee19ce5fcce
SHA1

b33d45b7543cd81de3d8c06b9219ec7605710551
SHA256

a2d53a525fa5c5c77a38ba9c7a1a759267e313aca806d064570fc068e913cf45
SHA512

e83d08a654e98e33c1b1f5384e2ae401e5261823e3fbb440f7ecdd7b29687a2ed10bcaddb26b669c8a87055257f6d2d9d4215ebfaafd0c88322cbe4b1ce4ebd8
SSDEEP

384:AQEJH3vLovF12pBFD5IU4P1SQATxELBEzR:IBzij24Szt0

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3648	GOD2.exe

Loads dropped DLL 1 IoCs

pid	Process
3648	GOD2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\registryStart = "C:\\Windows\\GOD2.exe"	GOD2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\a2.dll	GOD2.exe
File created	C:\Windows\SysWOW64\a1.dll	GOD2.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\GOD2.exe	e23aafbe57a58f302b4f6ee19ce5fcce.exe
File opened for modification	C:\Windows\GOD2.exe	e23aafbe57a58f302b4f6ee19ce5fcce.exe
File created	C:\Windows\GOD2.exe	GOD2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3648	GOD2.exe
3648	GOD2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3648	GOD2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 3648	4784	e23aafbe57a58f302b4f6ee19ce5fcce.exe	94
PID 4784 wrote to memory of 3648	4784	e23aafbe57a58f302b4f6ee19ce5fcce.exe	94
PID 4784 wrote to memory of 3648	4784	e23aafbe57a58f302b4f6ee19ce5fcce.exe	94

C:\Users\Admin\AppData\Local\Temp\e23aafbe57a58f302b4f6ee19ce5fcce.exe
"C:\Users\Admin\AppData\Local\Temp\e23aafbe57a58f302b4f6ee19ce5fcce.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\GOD2.exe
  C:\Windows\GOD2.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2384 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\GOD2.exe

Filesize
19KB

MD5
e23aafbe57a58f302b4f6ee19ce5fcce

SHA1
b33d45b7543cd81de3d8c06b9219ec7605710551

SHA256
a2d53a525fa5c5c77a38ba9c7a1a759267e313aca806d064570fc068e913cf45

SHA512
e83d08a654e98e33c1b1f5384e2ae401e5261823e3fbb440f7ecdd7b29687a2ed10bcaddb26b669c8a87055257f6d2d9d4215ebfaafd0c88322cbe4b1ce4ebd8

Download Submit
C:\Windows\SysWOW64\a1.dll

Filesize
6KB

MD5
2af02be5ae030b2e43c3c27753ccdc4d

SHA1
db8b3382034fb20434976af2e20403fe9fca129a

SHA256
2d8a6157f6d7aff2ce6edc2dd904020f9e260da1e349c25eb6a8b073edd9ed36

SHA512
4d20b81fa6106086fec5c20089e49e7c1b8922b1b4e7ea5d080c942ec1e5364d9817830b38578e6ca717123e9404bfe06bb0141f5cf464688e6635278c687733

Download Submit
memory/3648-11-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4784-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4784-5-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download