ad83d5d6a344f630ec62a81a693fa72df979d6898d8f7c978fe44763aa95a325

Analysis

max time kernel
156s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0cf7237e5aba506c3254c671fed72811.exe
Size

129KB
MD5

0cf7237e5aba506c3254c671fed72811
SHA1

2834418e15e0d0c02a6113c2a90bf12c2dc89564
SHA256

ad83d5d6a344f630ec62a81a693fa72df979d6898d8f7c978fe44763aa95a325
SHA512

b3d816ce775eb436c4f19c4f1b381e1b90173baa04c026f2077465e95bac2ea452ce8ab1003ed5bb3b85ab84930357d3bfe6629860ab1c38e9b271e22a902914
SSDEEP

3072:1/eOrj+K1j+stAo7jpD73KvTYEIQkeJTq:tBlAQd3eCQTJ+

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
4360	crdkdxb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\crdkdxb.exe	0cf7237e5aba506c3254c671fed72811.exe
File created	C:\PROGRA~3\Mozilla\xczzoaa.dll	crdkdxb.exe

C:\Users\Admin\AppData\Local\Temp\0cf7237e5aba506c3254c671fed72811.exe
"C:\Users\Admin\AppData\Local\Temp\0cf7237e5aba506c3254c671fed72811.exe"
1⤵
- Drops file in Program Files directory
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5072 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:2688

C:\PROGRA~3\Mozilla\crdkdxb.exe
C:\PROGRA~3\Mozilla\crdkdxb.exe -ofessij
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\crdkdxb.exe

Filesize
129KB

MD5
7718fd1ccab88fb45f2a890e0427cb22

SHA1
9f1c9ba30d509c2dfcfb4342604087764359eea9

SHA256
4b9cd013b5d03679db70f201649b5ab1c3c8d98cd66a21a400dd3723ee18abc0

SHA512
336082b8fb9275b08b575224a5e660392d9567959dbaab58ffed1da9c1afca99110e6a1bd572ccc285a761574158f45cecfcccdd782e16eb1d240d4ba5eb08be

Download Submit
memory/3700-3-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/3700-2-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3700-0-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3700-4-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3700-7-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3700-1-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/3700-11-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4360-13-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4360-14-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4360-15-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4360-18-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/4360-20-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download