8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
Size

299KB
MD5

6ff47a93249551f5b4bf2207900366de
SHA1

205f290e41b6daa9ab21a9a8772bd83d58feaa8a
SHA256

8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f
SHA512

499aec7d357ca80b06f8d9a021ea9d223d54fc978039da7a4b7f0995ed7906f1a2aadef9a0c13559107fb8944ee4e57e8311139318d21ab0d7e252f79b0f40da
SSDEEP

6144:xbF3pSw85DxsoKrlrPE3TtaoybMSeLng4TI:xB3/YxsoKrlriTpSeLndTI

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
5000	crdkdxb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\crdkdxb.exe	8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
File created	C:\PROGRA~3\Mozilla\xczzoaa.dll	crdkdxb.exe

C:\Users\Admin\AppData\Local\Temp\8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe
"C:\Users\Admin\AppData\Local\Temp\8ebfbc62b624487a823b5a094a6aec7d1f300c278eb6d2260c441020257e912f.exe"
1⤵
- Drops file in Program Files directory
PID:4860

C:\PROGRA~3\Mozilla\crdkdxb.exe
C:\PROGRA~3\Mozilla\crdkdxb.exe -ofessij
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\crdkdxb.exe

Filesize
299KB

MD5
6b24730251880666f6c17cd94440f898

SHA1
64dd75899dde3c89f501628894107de02aa018cf

SHA256
eeb823bfffc8dc5dbf96b7e65b5c4f7943b12f25b0ef2e8d706dbb530ff7351e

SHA512
e121685686d3670f8570a0df5cc45657acbe758d29814c372c81830b0010fe376104bd7d115184194f005342e42d4cf526af4582f72c6b3457fecb074fbceb50

Download Submit
memory/4860-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4860-1-0x00000000021E0000-0x000000000223B000-memory.dmp

Filesize
364KB

Download
memory/4860-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4860-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4860-9-0x00000000021E0000-0x000000000223B000-memory.dmp

Filesize
364KB

Download
memory/5000-10-0x0000000000D70000-0x0000000000DCB000-memory.dmp

Filesize
364KB

Download
memory/5000-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5000-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5000-16-0x0000000000D70000-0x0000000000DCB000-memory.dmp

Filesize
364KB

Download