Overview

overview

10

Static

static

3

33e1647606...38.exe

windows7-x64

10

33e1647606...38.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 01:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    33e1647606e1becff44664ea20173a31eeae6ebdd3d4b00aec5b246a0e560d38.exe

  • Size

    506KB

  • MD5

    cb5cc14425731461805aa6d8715b6a8a

  • SHA1

    ee3ef8ce1cc4ad172403f15d7aca35d3352e3581

  • SHA256

    33e1647606e1becff44664ea20173a31eeae6ebdd3d4b00aec5b246a0e560d38

  • SHA512

    6ce0b6fb1bb1eae8abcd4aa8d4be76c656d9c552e6f7b65c67d31a22f82058e8dd466b3641c4be905f5cc7d6f3d6e87cf96d5462bec16fb251d5c978c921b9e7

  • SSDEEP

    6144:NNc1bR5K4MoOhXGuGEJbqVFcC7LNe6VlWT8b9ddgdggmbHUVczFmkr0H:UBbIXGunCCELNPVle8FgxVVkr0H

Score
10/10
persistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies AppInit DLL entries 2 TTPs
    persistence
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\33e1647606e1becff44664ea20173a31eeae6ebdd3d4b00aec5b246a0e560d38.exe
    "C:\Users\Admin\AppData\Local\Temp\33e1647606e1becff44664ea20173a31eeae6ebdd3d4b00aec5b246a0e560d38.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "qehrfss" /tr "C:\Program Files\Sub\cmd.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "qehrfss" /tr "C:\Program Files\Sub\cmd.exe"
        3⤵
        • Creates scheduled task(s)
        PID:612
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "dllsys32" /tr "C:\Users\Admin\Sub\lbj.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "dllsys32" /tr "C:\Users\Admin\Sub\lbj.exe" /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:2332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Sub\cmd.exe
    Filesize

    506KB

    MD5

    cb5cc14425731461805aa6d8715b6a8a

    SHA1

    ee3ef8ce1cc4ad172403f15d7aca35d3352e3581

    SHA256

    33e1647606e1becff44664ea20173a31eeae6ebdd3d4b00aec5b246a0e560d38

    SHA512

    6ce0b6fb1bb1eae8abcd4aa8d4be76c656d9c552e6f7b65c67d31a22f82058e8dd466b3641c4be905f5cc7d6f3d6e87cf96d5462bec16fb251d5c978c921b9e7

    Download Submit

  • C:\Windows\xdwd.dll
    Filesize

    136KB

    MD5

    16e5a492c9c6ae34c59683be9c51fa31

    SHA1

    97031b41f5c56f371c28ae0d62a2df7d585adaba

    SHA256

    35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

    SHA512

    20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

    Download Submit

  • memory/956-0-0x0000000000C80000-0x0000000000D04000-memory.dmp

    Filesize

    528KB

    Download

  • memory/956-1-0x00007FFBFB903000-0x00007FFBFB905000-memory.dmp

    Filesize

    8KB

    Download

  • memory/956-46-0x00007FFBFB900000-0x00007FFBFC3C1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/956-132-0x00007FFBFB903000-0x00007FFBFB905000-memory.dmp

    Filesize

    8KB

    Download

  • memory/956-270-0x00007FFBFB900000-0x00007FFBFC3C1000-memory.dmp

    Filesize

    10.8MB

    Download