8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
Size

299KB
MD5

6ff47a93249551f5b4bf2207900366de
SHA1

205f290e41b6daa9ab21a9a8772bd83d58feaa8a
SHA256

8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f
SHA512

499aec7d357ca80b06f8d9a021ea9d223d54fc978039da7a4b7f0995ed7906f1a2aadef9a0c13559107fb8944ee4e57e8311139318d21ab0d7e252f79b0f40da
SSDEEP

6144:xbF3pSw85DxsoKrlrPE3TtaoybMSeLng4TI:xB3/YxsoKrlriTpSeLndTI

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2944	tbckyxk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tbckyxk.exe	8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
File created	C:\PROGRA~3\Mozilla\newtrln.dll	tbckyxk.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2068	8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
2944	tbckyxk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2944	2596	taskeng.exe	29
PID 2596 wrote to memory of 2944	2596	taskeng.exe	29
PID 2596 wrote to memory of 2944	2596	taskeng.exe	29
PID 2596 wrote to memory of 2944	2596	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
"C:\Users\Admin\AppData\Local\Temp\8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2068

C:\Windows\system32\taskeng.exe
taskeng.exe {D04852F5-92CE-4E13-BC3A-1C63E19CAD1F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2596
- C:\PROGRA~3\Mozilla\tbckyxk.exe
  C:\PROGRA~3\Mozilla\tbckyxk.exe -gqpcbye
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\tbckyxk.exe

Filesize
299KB

MD5
386fdcb0a538fc1f18c6c38c65dd6227

SHA1
8e21cd2919fe1eedc9d28770bec8c14c453b2d69

SHA256
e70e4e7db390279e7faed600829d74c73abb7804bd1c98de78a572e04756a3a0

SHA512
46e050a9d344f717d157ac902c6d2c3af704fc243358648d26a52b6af888b9046651c273be7828acaab7db022293fce6f586f2fb4fe8bc8737650372cea91645

Download Submit
memory/2068-2-0x0000000000250000-0x00000000002AB000-memory.dmp

Filesize
364KB

Download
memory/2068-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2068-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2068-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2944-7-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2944-8-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/2944-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2944-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download