80ea11dfcaf13b8157ebd9ac2aa4ec713e1a825aa267406b103f7e998f7ecf9e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80ea11dfcaf13b8157ebd9ac2aa4ec713e1a825aa267406b103f7e998f7ecf9e.exe
Size

142KB
MD5

94635116e7a8734623e2a45a6c5c3472
SHA1

f06f9dc3fcc8eb7ac029e70e2b404780349ef916
SHA256

80ea11dfcaf13b8157ebd9ac2aa4ec713e1a825aa267406b103f7e998f7ecf9e
SHA512

f8f00b8eff6f23b5eb287115bb19c1a8f8252690db2cb2c448bfb3dc17be30a96f37b13bea8e9891d1e9d689d56457d036290b7230b50498d40b3f9c71f06837
SSDEEP

3072:/opJoXWeRTQRxD0OBHFXX/rtkJMbMUj8rellOMfU5EJcDDXFC:aomwTYD0CXBGMIU1yTEevVC

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2632	nhadrjb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nhadrjb.exe	80ea11dfcaf13b8157ebd9ac2aa4ec713e1a825aa267406b103f7e998f7ecf9e.exe
File created	C:\PROGRA~3\Mozilla\mrcfdgn.dll	nhadrjb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2632	3060	taskeng.exe	29
PID 3060 wrote to memory of 2632	3060	taskeng.exe	29
PID 3060 wrote to memory of 2632	3060	taskeng.exe	29
PID 3060 wrote to memory of 2632	3060	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\80ea11dfcaf13b8157ebd9ac2aa4ec713e1a825aa267406b103f7e998f7ecf9e.exe
"C:\Users\Admin\AppData\Local\Temp\80ea11dfcaf13b8157ebd9ac2aa4ec713e1a825aa267406b103f7e998f7ecf9e.exe"
1⤵
- Drops file in Program Files directory
PID:2352

C:\Windows\system32\taskeng.exe
taskeng.exe {F7287D22-6B1C-4A54-A4D8-B5928830441A} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\PROGRA~3\Mozilla\nhadrjb.exe
  C:\PROGRA~3\Mozilla\nhadrjb.exe -giukxrm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nhadrjb.exe

Filesize
142KB

MD5
0a23db7e736360c0b8bd9942ce653d0a

SHA1
68359cf5cd7f7a39fad318976dd2a5714cff205a

SHA256
ebfe8b5ff69bdb9f97c8e6724edf2c31484936aa4237d37081a97f2ab1a48d6d

SHA512
f8c098582f038695460b548f15a8ea5262c3291cebf7833f6530fdd24fed97b52f75b63e560afa43a5163aa1701280618159dcb6a0a1b85c92afc6ab5711f570

Download Submit
memory/2352-0-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2352-1-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2352-2-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/2352-3-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2352-7-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2632-10-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2632-11-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2632-16-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download