Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
-
Size
390KB
-
MD5
8c64181ff0dc12c87e443aae94bf6650
-
SHA1
e91d7ebd17912785caa3e71ef1571dc01b1cd854
-
SHA256
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
-
SHA512
4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
-
SSDEEP
12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
Score
10/10
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule behavioral2/files/0x00080000000233ea-17.dat mimikatz -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe -
Executes dropped EXE 1 IoCs
pid Process 4848 6031.tmp -
Loads dropped DLL 1 IoCs
pid Process 1056 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe rundll32.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\7z.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe rundll32.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe rundll32.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe rundll32.exe File opened for modification C:\Program Files\ResolveComplete.pptx rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe rundll32.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmti.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE rundll32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\dllhost.dat rundll32.exe File created C:\Windows\dllcm.dat 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe File opened for modification C:\Windows\dllcm.dat rundll32.exe File created C:\Windows\dllcm rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4332 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1056 rundll32.exe 1056 rundll32.exe 4848 6031.tmp 4848 6031.tmp 4848 6031.tmp 4848 6031.tmp 4848 6031.tmp 4848 6031.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 1056 rundll32.exe Token: SeDebugPrivilege 1056 rundll32.exe Token: SeTcbPrivilege 1056 rundll32.exe Token: SeDebugPrivilege 4848 6031.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2836 wrote to memory of 1056 2836 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe 85 PID 2836 wrote to memory of 1056 2836 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe 85 PID 2836 wrote to memory of 1056 2836 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe 85 PID 1056 wrote to memory of 4496 1056 rundll32.exe 86 PID 1056 wrote to memory of 4496 1056 rundll32.exe 86 PID 1056 wrote to memory of 4496 1056 rundll32.exe 86 PID 1056 wrote to memory of 4848 1056 rundll32.exe 88 PID 1056 wrote to memory of 4848 1056 rundll32.exe 88 PID 4496 wrote to memory of 4332 4496 cmd.exe 90 PID 4496 wrote to memory of 4332 4496 cmd.exe 90 PID 4496 wrote to memory of 4332 4496 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #12⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 15:213⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 15:214⤵
- Creates scheduled task(s)
PID:4332
-
-
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp" \\.\pipe\{2FF0A14C-672E-46AC-8271-1A15BD439BEC}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD57e37ab34ecdcc3e77e24522ddfd4852d
SHA138e2855e11e353cedf9a8a4f2f2747f1c5c07fcf
SHA25602ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
SHA5121b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587
-
Filesize
353KB
MD57c0747971df2d07ceca15f0edc0a9f6e
SHA14db833ba4ddf88c36d6956928721547e1e221c0d
SHA2564dd22017d6f77573cc0f4999d22b45f1d71e6435350d4a5654ee1e93fec30827
SHA512d5da33a23fa39441901b9f4cc08468692d076545ffd29c082982fde7e93bb27464445478a37629a47d56594fd019863a1de52573c47ccf8d2252eb2047f8606e