Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe
-
Size
405KB
-
MD5
778b51f983e571844c64ceb1bf5a538c
-
SHA1
ee409dff7b6552a7b5825b0618e8dc7d22c827b6
-
SHA256
48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af
-
SHA512
919cdf56b7743dd0d1d7fcec45a915b24e735b247a21eb3e91432bfe788a7f8730809766019390996bddd09f7062d48b280d47f8fb7c5c85a97163bac6683132
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 3 2740 rundll32.exe 5 2740 rundll32.exe 8 2740 rundll32.exe 9 2740 rundll32.exe 10 2740 rundll32.exe 13 2740 rundll32.exe 14 2740 rundll32.exe 15 2740 rundll32.exe 17 2740 rundll32.exe 18 2740 rundll32.exe -
Deletes itself 1 IoCs
pid Process 2836 tesrqxcot.exe -
Executes dropped EXE 1 IoCs
pid Process 2836 tesrqxcot.exe -
Loads dropped DLL 6 IoCs
pid Process 2316 cmd.exe 2316 cmd.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\tnjnjcd\\hwanz.dll\",Verify" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\r: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2740 rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\tnjnjcd tesrqxcot.exe File created \??\c:\Program Files\tnjnjcd\hwanz.dll tesrqxcot.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2456 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2740 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2052 48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe 2836 tesrqxcot.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2316 2052 48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe 28 PID 2052 wrote to memory of 2316 2052 48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe 28 PID 2052 wrote to memory of 2316 2052 48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe 28 PID 2052 wrote to memory of 2316 2052 48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe 28 PID 2316 wrote to memory of 2456 2316 cmd.exe 30 PID 2316 wrote to memory of 2456 2316 cmd.exe 30 PID 2316 wrote to memory of 2456 2316 cmd.exe 30 PID 2316 wrote to memory of 2456 2316 cmd.exe 30 PID 2316 wrote to memory of 2836 2316 cmd.exe 31 PID 2316 wrote to memory of 2836 2316 cmd.exe 31 PID 2316 wrote to memory of 2836 2316 cmd.exe 31 PID 2316 wrote to memory of 2836 2316 cmd.exe 31 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32 PID 2836 wrote to memory of 2740 2836 tesrqxcot.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe"C:\Users\Admin\AppData\Local\Temp\48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\tesrqxcot.exe "C:\Users\Admin\AppData\Local\Temp\48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2456
-
-
C:\Users\Admin\AppData\Local\Temp\tesrqxcot.exeC:\Users\Admin\AppData\Local\Temp\\tesrqxcot.exe "C:\Users\Admin\AppData\Local\Temp\48649bb931de0f0946796d22b896624a8ab011abcd5053e929ca448558a1b6af.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\tnjnjcd\hwanz.dll",Verify C:\Users\Admin\AppData\Local\Temp\tesrqxcot.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD527e9a6d45aba0eb4b762da4f272a9d88
SHA10c24c44a6f4b78e7b678c23f7dceed29d70928b4
SHA2569644143850528d3e97c9fa9bba0bc83892749bf3ac57ebf608efdac1da1df700
SHA512aa8dc3286e3b8e1cfd6f4cf7cf43e320376615f3176cab4d146007effca6702b90ae7a78ea29d22b34eb87075ac8ee25427ecdf4b1d837d1b187b981bb0851b4
-
Filesize
405KB
MD523ad4a1c0ca0340c04c5907baf9c2331
SHA180d74299f0556ef5337c3579f0da3acf2ce5e59f
SHA256b2a64e9831d7894eec472cbdeee912bf0d765d52328bc6532098da199ad1da1a
SHA512937c63d6f12891d149508848a02b8d2a2be86dd02f5f9943fb0cf76d6e1f3c5f4b4573c3a7631511992a56994871f4c6b81b8b518ef8027d12be05a7813ac1de