9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Size 379KB
Sample240404-3ada6aea26
SHA256 9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471
MD5 4550fc560f247915115f6559f8ef6762
SHA1 672dd57eebae200477fa7470d856726ff9878336
SHA512 74b92a6be549f0d87b3e0dedbadab9157eebc5e162192e62c82742221d514f12b0cc7bc9b56d047c22f478a1ed49938c3b89a376be351a39efa00f8c1ac1e620
SSDEEP 6144:PBMGBT+4fjqPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8m30gsb:P8uCuqFHRFbeE8m5s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe

Executes dropped EXE 5 IoCs

pid	Process
4944	Dodbbdbb.exe
2728	Dogogcpo.exe
4464	Deagdn32.exe
1812	Dgbdlf32.exe
2072	Dmllipeg.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
File opened for modification	C:\Windows\SysWOW64\Dogogcpo.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1388	2072	WerFault.exe	88

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dogogcpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4944	4216	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe	84
PID 4216 wrote to memory of 4944	4216	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe	84
PID 4216 wrote to memory of 4944	4216	9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe	84
PID 4944 wrote to memory of 2728	4944	Dodbbdbb.exe	85
PID 4944 wrote to memory of 2728	4944	Dodbbdbb.exe	85
PID 4944 wrote to memory of 2728	4944	Dodbbdbb.exe	85
PID 2728 wrote to memory of 4464	2728	Dogogcpo.exe	86
PID 2728 wrote to memory of 4464	2728	Dogogcpo.exe	86
PID 2728 wrote to memory of 4464	2728	Dogogcpo.exe	86
PID 4464 wrote to memory of 1812	4464	Deagdn32.exe	87
PID 4464 wrote to memory of 1812	4464	Deagdn32.exe	87
PID 4464 wrote to memory of 1812	4464	Deagdn32.exe	87
PID 1812 wrote to memory of 2072	1812	Dgbdlf32.exe	88
PID 1812 wrote to memory of 2072	1812	Dgbdlf32.exe	88
PID 1812 wrote to memory of 2072	1812	Dgbdlf32.exe	88

C:\Users\Admin\AppData\Local\Temp\9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe
"C:\Users\Admin\AppData\Local\Temp\9aa2d5273cb488658cdf032c6e7df98894e54a2eb3482ddb7364a27299902471.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\Dodbbdbb.exe
  C:\Windows\system32\Dodbbdbb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\Dogogcpo.exe
    C:\Windows\system32\Dogogcpo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\Deagdn32.exe
      C:\Windows\system32\Deagdn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1812
      - C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        6⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 396
        7⤵
        Program crash
        
        PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2072 -ip 2072
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Deagdn32.exe

Path C:\Windows\SysWOW64\Deagdn32.exe
Size 379KB
SHA256 02224eb35931dad215bc981a94e00e9b92917bfff728ca5851b303104cab3372
MD5 fbf84b59b6521cd4c16b1b931fd7e410
SHA1 561502bebe6a040bd78228c068eda3372319ff17
SHA512 0fe447308309329b678db7e23e1be924e7fa5b186f33e5cc2c367ef7716d584ad0174bf15d8a47626c9c22424a4d0f95210c2de8cfac3109fd90e6a69dace13e
SSDEEP 6144:dyWoUsFPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8m30gsb:d1oUmuqFHRFbeE8m5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dgbdlf32.exe

Path C:\Windows\SysWOW64\Dgbdlf32.exe
Size 379KB
SHA256 963e703c6c81d0726a7ec9c5d4a4e2fa569dbc313ffe1fd26b94ed9d63f9ef0f
MD5 dfb8c32084b25d1ca892aa623c0cd7c9
SHA1 b4d7348415b2ef12ec5b20395110ba6beb39aea3
SHA512 e47e5f73fa7e0dce8e1772866715a37214206efac956827d6c14d4714a6c6ddd64556b8b02778fcfce3d40c1f384007f05f7ebc6cdd7345e5e8747f9102afdf0
SSDEEP 6144:oHLXvVjVtPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8m30gsb:oHL/RuqFHRFbeE8m5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmllipeg.exe

Path C:\Windows\SysWOW64\Dmllipeg.exe
Size 379KB
SHA256 d2e87d0670bdef8af67e50d9c7d8ec3544266d21914720232fae9453af1d9156
MD5 1e0573a2115edc70ada79ef78de3dddc
SHA1 0f68143dbaecd09b40b727b6a6af1c62aabe23e8
SHA512 dbcfe2441b6cb86422e2a6850168447c7587a00e6c8811f918c6e0521d442de1f8d8b17c8b379f3e64de11a7ab3a168318836f37b8eafd3b18e4e3972bb0fcc1
SSDEEP 6144:rRMMxZB6tPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8m30gsb:rRMM6uqFHRFbeE8m5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dodbbdbb.exe

Path C:\Windows\SysWOW64\Dodbbdbb.exe
Size 379KB
SHA256 a2d918ddf671d7baa596bbff6825742b7c1306de59d5f0b89634641434c7df62
MD5 0dd067d5e5ec5b15f0169042bdd4f541
SHA1 49cc3aeb43494fd207ce79181d2182f3fe7ed076
SHA512 cc47c19ae7d83c20ef89bc9e267ee850b2d75e44b2df5340e6ebe9ad5163450639ce0f3e77399c33658b60200b4d1e4b4b9b1f5735cfd242aacd96d514a7f003
SSDEEP 6144:LxPpcmW3clKTPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8m30gsb:LUjuqFHRFbeE8m5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dogogcpo.exe

Path C:\Windows\SysWOW64\Dogogcpo.exe
Size 379KB
SHA256 b94938b8aae8cabe7d25447d5d903f7588379f4a2d2eeabf8effcd5c20d8abc2
MD5 5bcf1bff23a2c700459ebd2b3cd94310
SHA1 6f309675c35501c024e0b9467c50b9cb773b80be
SHA512 6a6d89174e5b7753dafb10900214bd86ac7a128cd20bbd3f6d1aaad36be84c8f8796883b93a900ebc777d3fcb848352b63c46a16febe4df6cfe0494e752f4c82
SSDEEP 6144:+O6RAmGVLLKPXuapoaCPXbo92ynnZlVrtv35CPXbo92ynn8sbeWDSpaH8m30gsb:pyGguqFHRFbeE8m5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1812-41-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2072-40-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2728-17-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2728-42-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4216-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4216-5-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4216-44-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4464-32-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4944-9-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4944-43-0x0000000000400000-0x0000000000440000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads