Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 08:04
Static task
static1
Behavioral task
behavioral1
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win10v2004-20240226-en
General
-
Target
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
-
Size
390KB
-
MD5
8c64181ff0dc12c87e443aae94bf6650
-
SHA1
e91d7ebd17912785caa3e71ef1571dc01b1cd854
-
SHA256
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
-
SHA512
4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
-
SSDEEP
12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\5880.tmp mimikatz -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe -
Executes dropped EXE 1 IoCs
Processes:
5880.tmppid process 4876 5880.tmp -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 844 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A6BE8446-37D6-48C4-B9D2-938299E1D673}\MicrosoftEdgeUpdateSetup_X86_1.3.185.17.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\java.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Bus Schedule.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91140\javaw.exe rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdate.exe rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe rundll32.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe rundll32.exe File opened for modification C:\Program Files\RestartRename.cfg rundll32.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe rundll32.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\javafx-src.zip rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE rundll32.exe -
Drops file in Windows directory 4 IoCs
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exerundll32.exedescription ioc process File created C:\Windows\dllcm.dat 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe File opened for modification C:\Windows\dllcm.dat rundll32.exe File created C:\Windows\dllcm rundll32.exe File created C:\Windows\dllhost.dat rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exe5880.tmppid process 844 rundll32.exe 844 rundll32.exe 4876 5880.tmp 4876 5880.tmp 4876 5880.tmp 4876 5880.tmp 4876 5880.tmp 4876 5880.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exe5880.tmpdescription pid process Token: SeShutdownPrivilege 844 rundll32.exe Token: SeDebugPrivilege 844 rundll32.exe Token: SeTcbPrivilege 844 rundll32.exe Token: SeDebugPrivilege 4876 5880.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exerundll32.execmd.exedescription pid process target process PID 4652 wrote to memory of 844 4652 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 4652 wrote to memory of 844 4652 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 4652 wrote to memory of 844 4652 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe rundll32.exe PID 844 wrote to memory of 1648 844 rundll32.exe cmd.exe PID 844 wrote to memory of 1648 844 rundll32.exe cmd.exe PID 844 wrote to memory of 1648 844 rundll32.exe cmd.exe PID 844 wrote to memory of 4876 844 rundll32.exe 5880.tmp PID 844 wrote to memory of 4876 844 rundll32.exe 5880.tmp PID 1648 wrote to memory of 892 1648 cmd.exe schtasks.exe PID 1648 wrote to memory of 892 1648 cmd.exe schtasks.exe PID 1648 wrote to memory of 892 1648 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #12⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 09:073⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 09:074⤵
- Creates scheduled task(s)
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp" \\.\pipe\{386F40DF-6663-4233-8E35-5BACB4AF62E3}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD57e37ab34ecdcc3e77e24522ddfd4852d
SHA138e2855e11e353cedf9a8a4f2f2747f1c5c07fcf
SHA25602ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
SHA5121b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587
-
Filesize
353KB
MD57c0747971df2d07ceca15f0edc0a9f6e
SHA14db833ba4ddf88c36d6956928721547e1e221c0d
SHA2564dd22017d6f77573cc0f4999d22b45f1d71e6435350d4a5654ee1e93fec30827
SHA512d5da33a23fa39441901b9f4cc08468692d076545ffd29c082982fde7e93bb27464445478a37629a47d56594fd019863a1de52573c47ccf8d2252eb2047f8606e