Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe
Resource
win7-20240215-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe
- Size 405KB
- Sample240509-dss2wsad83
- SHA256 63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a
- MD5 8847706c7b585ae2d124a0dffea1b858
- SHA1 f983b9409a8341846eb5b84801ed65eb70671b03
- SHA512 6ee7937f99b263bfabc02131b3972693fc1d4ddce92d67f846e39f219ea7a168f8875bd04eb3ae16844d4ffadd280a5f86854160551ba3a67c199a60e5fca9b6
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4U:gtRfJcNYFNm8UhlZGseU
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 8 IoCs
flow pid Process 14 4932 rundll32.exe 15 4932 rundll32.exe 16 4932 rundll32.exe 17 4932 rundll32.exe 19 4932 rundll32.exe 20 4932 rundll32.exe 25 4932 rundll32.exe 28 4932 rundll32.exe - Deletes itself 1 IoCs
pid Process 4388 vxemjxfnx.exe - Executes dropped EXE 1 IoCs
pid Process 4388 vxemjxfnx.exe - Loads dropped DLL 1 IoCs
pid Process 4932 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\pcgbu\\awyaq.dll\",Verify" rundll32.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\w: rundll32.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4932 rundll32.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\pcgbu vxemjxfnx.exe File created \??\c:\Program Files\pcgbu\awyaq.dll vxemjxfnx.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2312 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe 4932 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4932 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4180 63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe 4388 vxemjxfnx.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4180 wrote to memory of 1908 4180 63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe 81 PID 4180 wrote to memory of 1908 4180 63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe 81 PID 4180 wrote to memory of 1908 4180 63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe 81 PID 1908 wrote to memory of 2312 1908 cmd.exe 83 PID 1908 wrote to memory of 2312 1908 cmd.exe 83 PID 1908 wrote to memory of 2312 1908 cmd.exe 83 PID 1908 wrote to memory of 4388 1908 cmd.exe 89 PID 1908 wrote to memory of 4388 1908 cmd.exe 89 PID 1908 wrote to memory of 4388 1908 cmd.exe 89 PID 4388 wrote to memory of 4932 4388 vxemjxfnx.exe 91 PID 4388 wrote to memory of 4932 4388 vxemjxfnx.exe 91 PID 4388 wrote to memory of 4932 4388 vxemjxfnx.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe"C:\Users\Admin\AppData\Local\Temp\63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\vxemjxfnx.exe "C:\Users\Admin\AppData\Local\Temp\63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2312
-
-
C:\Users\Admin\AppData\Local\Temp\vxemjxfnx.exeC:\Users\Admin\AppData\Local\Temp\\vxemjxfnx.exe "C:\Users\Admin\AppData\Local\Temp\63c536d29ff0b8a3e700e23539780459656bfd5f380b9d8b96b3fa6a6ec5d55a.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\pcgbu\awyaq.dll",Verify C:\Users\Admin\AppData\Local\Temp\vxemjxfnx.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\vxemjxfnx.exe
- Size 405KB
- SHA256 f08153f6c29de575b1cabed9aa0bfc924b990e3aa2addba33c87cef670bd0b83
- MD5 8cf3cc195e2207d84a4995b48f35eca2
- SHA1 08f69e2766d0017f7546b91929d2d1c6128ce1da
- SHA512 e4d7ae1954fa8941eab7dd2edabd7159c9e34f737977e6f55082e613566c541b1b3ad4fa7eaa2f1ff618ce7d087f0b3a2ffea381ffb28244749b5a25828d4656
- SSDEEP 6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4Q:gtRfJcNYFNm8UhlZGseQ
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Program Files\pcgbu\awyaq.dll
- Size 228KB
- SHA256 8c4329bfef2e52c2c37a42db751b3c9156577ef20dbd20afac4133356b2c82b6
- MD5 2d65fd70416feec4cb36f23dce8c9522
- SHA1 678394c326fe1f1f817113c5ba344583a6a2fa7f
- SHA512 dce4f467187a687a1d59e1396669bbb8a2327e551fa1a5b17b14a7a2b7309d1d7180319ef8d1763db6a54a5f0653719b78a9302cb35a33bd09e2de6b4da13b0e
- SSDEEP 6144:U1oEITTl5VCuHFrEy0wEOR7ndfAnVxERZ4CR3XaNy:5vVrHFrL05gdonVANp7
- MD5 SHA1 SHA512 SSDEEP