e468197214441e1317b7f792064ebea12a0b7dafea145c827a4565ee0aa7b4a7

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18cb91f5673a191fe542cdfd294db83f.exe
Size

150KB
MD5

18cb91f5673a191fe542cdfd294db83f
SHA1

851a6b9b682c64da979ab9cbdcc287e900298d73
SHA256

e468197214441e1317b7f792064ebea12a0b7dafea145c827a4565ee0aa7b4a7
SHA512

1e5120cc499509f743a8f195f8cbb55857c26dc17321103be16e9b1bed53d594851ae15d08f709ecd8061feeefff1cabd2b9d54a45d06ff7a91f1d0556868d4e
SSDEEP

3072:h/BH9p/3K+AEkzgXrGqJM4qd3bGjhkqsXbK:hR9pTAEkz6rGq4Bbq22

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2624	racmzae.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\racmzae.exe	18cb91f5673a191fe542cdfd294db83f.exe
File created	C:\PROGRA~3\Mozilla\ttbtowf.dll	racmzae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2624	2552	taskeng.exe	29
PID 2552 wrote to memory of 2624	2552	taskeng.exe	29
PID 2552 wrote to memory of 2624	2552	taskeng.exe	29
PID 2552 wrote to memory of 2624	2552	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\18cb91f5673a191fe542cdfd294db83f.exe
"C:\Users\Admin\AppData\Local\Temp\18cb91f5673a191fe542cdfd294db83f.exe"
1⤵
- Drops file in Program Files directory
PID:1888

C:\Windows\system32\taskeng.exe
taskeng.exe {360245B7-F185-43E9-957A-027AEC8787A0} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\PROGRA~3\Mozilla\racmzae.exe
  C:\PROGRA~3\Mozilla\racmzae.exe -cddhnyc
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\racmzae.exe

Filesize
150KB

MD5
0ac9e15f66b1e2ce661a3ffd31303ba9

SHA1
fbe81be05dbddf5231511f0b5eeff485e14ab4c2

SHA256
f64a2ff425734ed3a7e80c7348f7d0b1db6ca34918efc0c9f24fe2eb676265e8

SHA512
38583674cc5bf502d612c734c9cb79804dfeea4b622af1b3f6159d2a3c1b88dd80a23fe1d5da82f59d84c6465c1fa9797f4bd4eafb424ab1cac1de08e2a059be

Download Submit
memory/1888-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1888-1-0x0000000000250000-0x00000000002AB000-memory.dmp

Filesize
364KB

Download
memory/1888-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2624-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2624-11-0x0000000000390000-0x00000000003EB000-memory.dmp

Filesize
364KB

Download
memory/2624-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download