8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f.exe
Size

6.7MB
MD5

50385df19f957b903a16162568d5d844
SHA1

6299602980a42b3b36268581d9f5c1c95edc0c68
SHA256

8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f
SHA512

b440643a8f8e135e2d14ed786e2d085ca5633e09a26eb9a6058d65fb85da071fffac68de0400a5f8a3d1fd58dbe7c36d4e6b5708213aab2f76117f7600cd0804
SSDEEP

196608:iLmZYVW6eOSuI1uJAfiV4Yh/DMsQadFuETY5Wd:iLmr+SuGuCf/w4sQadFuEMO

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
4128	karhseb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\karhseb.exe	8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f.exe
File created	C:\PROGRA~3\Mozilla\tjiafxd.dll	karhseb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
228	8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f.exe
228	8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f.exe
4128	karhseb.exe
4128	karhseb.exe

C:\Users\Admin\AppData\Local\Temp\8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f.exe
"C:\Users\Admin\AppData\Local\Temp\8ffa4e0bcc37f03977ee0eb77dae2639cf360bfadfaead0b0fc304d1dbd8a78f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\PROGRA~3\Mozilla\karhseb.exe
C:\PROGRA~3\Mozilla\karhseb.exe -hfiexvb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\karhseb.exe

Filesize
6.7MB

MD5
844032d0f92249df7355017da5680cf0

SHA1
d1fd0a68af07ef81e93c913a661fc528e45fbcd6

SHA256
5238f0d429f16781c4709ba2588273e4e12c9e66bba2fcf1fcc071b25b7348ce

SHA512
3c0bba150582ff88e3c8625284e5add9fd5099e76d926a9d4fcd02d2711b3e78d63f2637fce602499ac0caea619a6b59fd9fcec682c20f01151d437abbae9470

Download Submit
memory/228-16-0x00000000009B0000-0x0000000001471000-memory.dmp

Filesize
10.8MB

Download
memory/228-4-0x00000000015D0000-0x00000000015D1000-memory.dmp

Filesize
4KB

Download
memory/228-1-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/228-7-0x0000000000A0C000-0x0000000000DC0000-memory.dmp

Filesize
3.7MB

Download
memory/228-6-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/228-5-0x00000000015E0000-0x00000000015E1000-memory.dmp

Filesize
4KB

Download
memory/228-0-0x00000000009B0000-0x0000000001471000-memory.dmp

Filesize
10.8MB

Download
memory/228-9-0x00000000009B0000-0x0000000001471000-memory.dmp

Filesize
10.8MB

Download
memory/228-8-0x0000000001900000-0x0000000001901000-memory.dmp

Filesize
4KB

Download
memory/228-12-0x00000000009B0000-0x0000000001471000-memory.dmp

Filesize
10.8MB

Download
memory/228-2-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/228-3-0x0000000001590000-0x0000000001591000-memory.dmp

Filesize
4KB

Download
memory/228-18-0x0000000000A0C000-0x0000000000DC0000-memory.dmp

Filesize
3.7MB

Download
memory/4128-21-0x0000000001120000-0x0000000001121000-memory.dmp

Filesize
4KB

Download
memory/4128-19-0x00000000000E0000-0x0000000000BA1000-memory.dmp

Filesize
10.8MB

Download
memory/4128-20-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/4128-17-0x00000000000E0000-0x0000000000BA1000-memory.dmp

Filesize
10.8MB

Download
memory/4128-23-0x00000000018C0000-0x00000000018C1000-memory.dmp

Filesize
4KB

Download
memory/4128-25-0x00000000018E0000-0x00000000018E1000-memory.dmp

Filesize
4KB

Download
memory/4128-26-0x00000000018F0000-0x00000000018F1000-memory.dmp

Filesize
4KB

Download
memory/4128-27-0x00000000000E0000-0x0000000000BA1000-memory.dmp

Filesize
10.8MB

Download
memory/4128-24-0x00000000018D0000-0x00000000018D1000-memory.dmp

Filesize
4KB

Download
memory/4128-22-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/4128-31-0x00000000000E0000-0x0000000000BA1000-memory.dmp

Filesize
10.8MB

Download