a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Size 368KB
Sample240404-3n9xaaee72
SHA256 a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9
MD5 279680eafee44d865a9473703ca41b59
SHA1 5556a70f5bb6acdc19bef39f33f41de575cb1b01
SHA512 c448d8bad69b7d2cc1d2db91b2f67062952a23baaf1babd2d9c799c5be5427a79b8fe378e8fc37b0319575b92a72b33f352e30efbdea5709df59c7fb079c2999
SSDEEP 6144:7nARxk9mcFgs3Tyg+SZ5L4pCglKy4E4f9FIUpOVw86CmOJfTo9FIUIhrcflDMxy1:7nA7kgcFJ3Tyg+SZ5L4prlK2aAD6RrIc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe

Executes dropped EXE 1 IoCs

pid	Process
312	Nkcmohbg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3720	312	WerFault.exe	86

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 312	5072	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe	86
PID 5072 wrote to memory of 312	5072	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe	86
PID 5072 wrote to memory of 312	5072	a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe	86

C:\Users\Admin\AppData\Local\Temp\a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe
"C:\Users\Admin\AppData\Local\Temp\a5c067b21366798001c36d74d2e0f01c82335bdb786be7fe24567d1049ddbcb9.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\Nkcmohbg.exe
  C:\Windows\system32\Nkcmohbg.exe
  2⤵
  - Executes dropped EXE
  PID:312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 412
    3⤵
    - Program crash
    PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 312 -ip 312
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 368KB
SHA256 9d9aceb8115dcfcd79bd6584c64f5338092c9ada56c760a10246bfe22a053106
MD5 0d72ab02ab0b601a0a400c138271e547
SHA1 10d461644a7fa2ce01816095dae3d00091cdceee
SHA512 2adcf1ca85baca7a462277261b98b4f2b31461fc3c486b4e8d3f2031d8d04f3ea5a7ad243873586b7068aed7107124a4e72fbc228035cecad710a7461e215a92
SSDEEP 6144:/+VoUeKE4f9FIUpOVw86CmOJfTo9FIUIhrcflDMxy9FIUpOVw86CmOJfTo9FIU28:skaAD6RrI1+lDMEAD6Rr2NWL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-7-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/312-9-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5072-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/5072-10-0x0000000000400000-0x0000000000439000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads