Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 07:14

General

  • Target

    399ad2d4276388eace22cfbb5ab5083a1ceb04ed268b539efaeab80750a992b2.exe

  • Size

    405KB

  • MD5

    46d7046511e97a1cdf512f8dea84e253

  • SHA1

    9ee8ddf44785ecc63b02570b7db97b1abf6bdb2a

  • SHA256

    399ad2d4276388eace22cfbb5ab5083a1ceb04ed268b539efaeab80750a992b2

  • SHA512

    46017fbbd0715d0984b711c5cb3757774fce47078ec341dd0f20f802355b62e9e4a0ec3be79e880fe48b817dce4ad81366a26a655fd9ecbc741fab48e782d749

  • SSDEEP

    6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4i:gtRfJcNYFNm8UhlZGsei

Malware Config

Signatures

  • Blocklisted process makes network request 10 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\399ad2d4276388eace22cfbb5ab5083a1ceb04ed268b539efaeab80750a992b2.exe
    "C:\Users\Admin\AppData\Local\Temp\399ad2d4276388eace22cfbb5ab5083a1ceb04ed268b539efaeab80750a992b2.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\qczzp.exe "C:\Users\Admin\AppData\Local\Temp\399ad2d4276388eace22cfbb5ab5083a1ceb04ed268b539efaeab80750a992b2.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • Runs ping.exe
        PID:2980
      • C:\Users\Admin\AppData\Local\Temp\qczzp.exe
        C:\Users\Admin\AppData\Local\Temp\\qczzp.exe "C:\Users\Admin\AppData\Local\Temp\399ad2d4276388eace22cfbb5ab5083a1ceb04ed268b539efaeab80750a992b2.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3036
        • \??\c:\windows\SysWOW64\rundll32.exe
          c:\windows\system32\rundll32.exe "c:\Program Files\mumlltpsm\dprgz.dll",Verify C:\Users\Admin\AppData\Local\Temp\qczzp.exe
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Adds Run key to start application
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2672

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\qczzp.exe

          Filesize

          405KB

          MD5

          4b0cbc710f0657e76ab511132d72dd8d

          SHA1

          4591d6db054ca9919f0d4e5fd66d9357eafd6b78

          SHA256

          ba2ba7b22d8229c188522b54d07ed3d6915e14e468fc5a1b879f1d8d7d4b7c35

          SHA512

          69486a98da468cf68945ca4baddff71acabd137a1628035bd5fd73ee45dcdd382713a214faa0518c4d9262f8b044c46d74986fceec4d03c668fa53e28dcb0432

        • \Program Files\mumlltpsm\dprgz.dll

          Filesize

          228KB

          MD5

          eee605772987be435566d9b7461ad9cc

          SHA1

          e5ecf62c599adb531da370d2914b26ac07c75be2

          SHA256

          cc1c04aabd0dba7572a55f052a077190846a60b91200e47a38b5f56fe9f6a0be

          SHA512

          8e079d14926e31a907f3fd110c71c208a0017a495c284254e57f4e39204ba8aa2c5b26bb1e020bde712260bcba7c47e4c40c4ea440c8a3f07a643bc952688260

        • memory/1320-8-0x0000000000190000-0x00000000001F4000-memory.dmp

          Filesize

          400KB

        • memory/1320-7-0x0000000000190000-0x00000000001F4000-memory.dmp

          Filesize

          400KB

        • memory/2496-0-0x0000000000400000-0x0000000000464000-memory.dmp

          Filesize

          400KB

        • memory/2496-2-0x0000000000400000-0x0000000000464000-memory.dmp

          Filesize

          400KB

        • memory/2672-21-0x0000000010000000-0x0000000010080000-memory.dmp

          Filesize

          512KB

        • memory/2672-20-0x0000000010000000-0x0000000010080000-memory.dmp

          Filesize

          512KB

        • memory/2672-19-0x0000000010000000-0x0000000010080000-memory.dmp

          Filesize

          512KB

        • memory/2672-18-0x0000000010000000-0x0000000010080000-memory.dmp

          Filesize

          512KB

        • memory/2672-17-0x0000000010000000-0x0000000010080000-memory.dmp

          Filesize

          512KB

        • memory/2672-23-0x0000000010000000-0x0000000010080000-memory.dmp

          Filesize

          512KB

        • memory/3036-9-0x0000000000400000-0x0000000000464000-memory.dmp

          Filesize

          400KB

        • memory/3036-11-0x0000000000400000-0x0000000000464000-memory.dmp

          Filesize

          400KB