3a7f74cd2b13d6e07cdeed5ea995eb6ac2fae1ece24f8ecfe41fc787fea6818d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

488b70a94b3dd2763544a008a193a84c.exe
Size

190KB
MD5

488b70a94b3dd2763544a008a193a84c
SHA1

5e79d8a35371b6b8990d14c016907c5107a1e515
SHA256

3a7f74cd2b13d6e07cdeed5ea995eb6ac2fae1ece24f8ecfe41fc787fea6818d
SHA512

8b8c1eb980a41d507d37fcd026f982ea3d526533374f72d352789758f8b3bfccc293d5fe1df0bfa9cc3ae597c961846f8a968f72a25a31cd907a90ef8653e1aa
SSDEEP

3072:gwnvjgmOlcIcka0lktlDjSTrcsNHGlt0qzbgCNYydJATCBKaypGQhc:lnvjomP/kk7+X+SSuydvKbzc

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2088	racmzae.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\racmzae.exe	488b70a94b3dd2763544a008a193a84c.exe
File created	C:\PROGRA~3\Mozilla\ttbtowf.dll	racmzae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2088	2940	taskeng.exe	29
PID 2940 wrote to memory of 2088	2940	taskeng.exe	29
PID 2940 wrote to memory of 2088	2940	taskeng.exe	29
PID 2940 wrote to memory of 2088	2940	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\488b70a94b3dd2763544a008a193a84c.exe
"C:\Users\Admin\AppData\Local\Temp\488b70a94b3dd2763544a008a193a84c.exe"
1⤵
- Drops file in Program Files directory
PID:3012

C:\Windows\system32\taskeng.exe
taskeng.exe {9D252D83-6D40-45E5-8FE4-698252152134} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\PROGRA~3\Mozilla\racmzae.exe
  C:\PROGRA~3\Mozilla\racmzae.exe -cddhnyc
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\racmzae.exe

Filesize
190KB

MD5
03ffd23b4defaef6b120fb857b0daea5

SHA1
f0a17dc420b3a9c71d369884fea75210e6352773

SHA256
931f0e48968547f526370e066b03b1834850aa7b39ce1971be81e262fa9d573f

SHA512
5042a95a92084f30059777f4763dcf301eda767ded5273283de1b51d82ed5865b536790273458760d3cfbd665171c8e36f05d9daed2880f016baa2ea1f56b67e

Download Submit
memory/2088-10-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2088-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2088-16-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3012-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3012-1-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3012-3-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/3012-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3012-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download