Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240412-en
General
-
Target
tmp.exe
-
Size
10.7MB
-
MD5
b091c4848287be6601d720997394d453
-
SHA1
9180e34175e1f4644d5fa63227d665b2be15c75b
-
SHA256
d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
-
SHA512
a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
SSDEEP
196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
Malware Config
Signatures
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
dckuybanmlgp.exepid process 468 2316 dckuybanmlgp.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 468 -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2532 sc.exe 2420 sc.exe 2668 sc.exe 2564 sc.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
tmp.exedckuybanmlgp.exepid process 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 1460 tmp.exe 2316 dckuybanmlgp.exe 2316 dckuybanmlgp.exe 2316 dckuybanmlgp.exe 2316 dckuybanmlgp.exe 2316 dckuybanmlgp.exe 2316 dckuybanmlgp.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeShutdownPrivilege 2604 powercfg.exe Token: SeShutdownPrivilege 2628 powercfg.exe Token: SeShutdownPrivilege 2716 powercfg.exe Token: SeShutdownPrivilege 2540 powercfg.exe Token: SeShutdownPrivilege 1392 powercfg.exe Token: SeShutdownPrivilege 2368 powercfg.exe Token: SeShutdownPrivilege 1940 powercfg.exe Token: SeShutdownPrivilege 2012 powercfg.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 2316 wrote to memory of 1872 2316 dckuybanmlgp.exe conhost.exe PID 2316 wrote to memory of 1872 2316 dckuybanmlgp.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeFilesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
memory/1460-7-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/1460-17-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/1460-5-0x0000000076EF0000-0x0000000076EF2000-memory.dmpFilesize
8KB
-
memory/1460-0-0x0000000076EF0000-0x0000000076EF2000-memory.dmpFilesize
8KB
-
memory/1460-9-0x0000000076D40000-0x0000000076EE9000-memory.dmpFilesize
1.7MB
-
memory/1460-10-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/1460-2-0x0000000076EF0000-0x0000000076EF2000-memory.dmpFilesize
8KB
-
memory/1460-3-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/1460-12-0x0000000076D40000-0x0000000076EE9000-memory.dmpFilesize
1.7MB
-
memory/1872-28-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2316-20-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2316-23-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2316-26-0x0000000076D40000-0x0000000076EE9000-memory.dmpFilesize
1.7MB
-
memory/2316-29-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2316-30-0x0000000076D40000-0x0000000076EE9000-memory.dmpFilesize
1.7MB