9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Size 352KB
Sample240404-3akegadc2v
SHA256 9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658
MD5 07a720ae15a526c72785850d90c07ff3
SHA1 31773042bbda1027999456df7bf01d0f2bade1e1
SHA512 508ac31964b2f06abc1303b33b64b686e59258ecbdbd6f36aec62f00b0cc6dc3c608860a57891979c17f4abc83ae7ce9c1637b2d1b0a1e8d3d62913d0aaea764
SSDEEP 6144:ZtZVCy524z9iWis/j9SrJz9ieis/j9SrJz9is/j9SrJwWisp:rCm+sUasUqsU6sp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe

Executes dropped EXE 3 IoCs

pid	Process
3248	Ngedij32.exe
220	Nbkhfc32.exe
2232	Nkcmohbg.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3908	2232	WerFault.exe	87

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3248	4600	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe	85
PID 4600 wrote to memory of 3248	4600	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe	85
PID 4600 wrote to memory of 3248	4600	9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe	85
PID 3248 wrote to memory of 220	3248	Ngedij32.exe	86
PID 3248 wrote to memory of 220	3248	Ngedij32.exe	86
PID 3248 wrote to memory of 220	3248	Ngedij32.exe	86
PID 220 wrote to memory of 2232	220	Nbkhfc32.exe	87
PID 220 wrote to memory of 2232	220	Nbkhfc32.exe	87
PID 220 wrote to memory of 2232	220	Nbkhfc32.exe	87

C:\Users\Admin\AppData\Local\Temp\9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe
"C:\Users\Admin\AppData\Local\Temp\9acc4e0eb1b7917400830e42c63884c9b627eefe9b0571c97c482c65994d2658.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\Ngedij32.exe
  C:\Windows\system32\Ngedij32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\Nbkhfc32.exe
    C:\Windows\system32\Nbkhfc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\SysWOW64\Nkcmohbg.exe
      C:\Windows\system32\Nkcmohbg.exe
      4⤵
      Executes dropped EXE
      PID:2232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 400
        5⤵
        Program crash
        
        PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2232 -ip 2232
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 352KB
SHA256 894dd7ac424c5a809986465fd88c7a2120b4c3e64d3040651286539d59d0289f
MD5 888bf1a1c0c21b12723c67c78766dadf
SHA1 324ac6f3bc8b8b383458d0f55ebe4f6185555eb8
SHA512 9e0b35ccacd8396a3aee0dc60e13b452c1e2a750c1796e412823d7f7dc04a9ea02f2c48bc9f999151512a094eb7130de78f0d0cf706a4db59e2dc97cd133034f
SSDEEP 6144:7nivRj1LJz9iWis/j9SrJz9ieis/j9SrJz9is/j9SrJwWisp:7qj1isUasUqsU6sp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 352KB
SHA256 21cc9a9469ec4a02eb2c9268340b646660c7884be23abc2d31fe10a75ff3324a
MD5 f0cc2480543a0be9938aaf92b64212b5
SHA1 926c82dc55ba3200ba456d11f668d6f008d7d08b
SHA512 d74f07f482f4d29d4d17fa399b687034da1afe0b428b3a01e91693a65b8e3ad76cd19eb55f21d7a0f2f136cc65cad56fadf4cad91179abf3df9cf120073a578e
SSDEEP 6144:+qnEmUXKCz9iWis/j9SrJz9ieis/j9SrJz9is/j9SrJwWisp:VDEssUasUqsU6sp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 352KB
SHA256 eed4731b76e4a5301697850c653edc43f9093a143ccb6fa08747dc36d34689e3
MD5 d988866b49daa4cf48e43d274b3da671
SHA1 51ed93e13020f7ab20dfe937bce791a1f778c5b6
SHA512 8c290defda967b838ea6701cd3d1f47e59279e3e0b34785d21cc2659fe31570066f7e5ae78f7385d6d7a0c331bf2cda37261fbf2e4e4557d0dc864d255baf9d3
SSDEEP 6144:ocLEGJMz9iWis/j9SrJz9ieis/j9SrJz9is/j9SrJwWisp:ocAGtsUasUqsU6sp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-29-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/220-17-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2232-25-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2232-28-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3248-9-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3248-32-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4600-5-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4600-0-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4600-33-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4600-34-0x0000000000400000-0x000000000047F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads