a9016da5a08308a7a513914ef556607e91146c05be8a4afe42b44a7a0028f685

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a9016da5a08308a7a513914ef556607e91146c05be8a4afe42b44a7a0028f685.exe
Size

140KB
MD5

e4e133e588303315dd01dcf82a984050
SHA1

9a7022863ff1e280f8a77a06bff3bc190a28b55b
SHA256

a9016da5a08308a7a513914ef556607e91146c05be8a4afe42b44a7a0028f685
SHA512

5a6738d7c973947a8346c2c737291738eaf92ef94100369c7e8ba5460c2aeb3d26413d8bfde8f77d22e8ce9f2bb112c4944a6b390041881e849fb29462cb8f5d
SSDEEP

3072:FC+b/xEwBxygI9vj0AT1smXA3HizrYZ6oXHqBNI5xR:k+LxBxULrsr3CffoXKBy5P

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
976	cncvcdl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\cncvcdl.exe	a9016da5a08308a7a513914ef556607e91146c05be8a4afe42b44a7a0028f685.exe
File created	C:\PROGRA~3\Mozilla\smohitc.dll	cncvcdl.exe

C:\Users\Admin\AppData\Local\Temp\a9016da5a08308a7a513914ef556607e91146c05be8a4afe42b44a7a0028f685.exe
"C:\Users\Admin\AppData\Local\Temp\a9016da5a08308a7a513914ef556607e91146c05be8a4afe42b44a7a0028f685.exe"
1⤵
- Drops file in Program Files directory
PID:2132

C:\PROGRA~3\Mozilla\cncvcdl.exe
C:\PROGRA~3\Mozilla\cncvcdl.exe -fxgvwzg
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\cncvcdl.exe

Filesize
140KB

MD5
875267016e996c3b160631d403567361

SHA1
292561638c7f6a5fe4569fad51188e5a2c079803

SHA256
2f7609c79b6c9c95d3297e7d2ce5806629ff8a7d60c58a19082ca2f3c71f96bb

SHA512
90fd36a58c99b9fbe40c3edb5ec859795eef255f0405383ecfa56d887cb2b3adde56b8900b0b7243312c981c8fc8e8e46153bfb5a2129e2bd0c836ca0cc130b2

Download Submit
memory/976-11-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/976-12-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/976-13-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/976-17-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2132-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2132-2-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2132-3-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/2132-1-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2132-4-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/2132-10-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download