Analysis
-
max time kernel
129s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-05-2024 03:14
Behavioral task
behavioral1
Sample
c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe
Resource
win10v2004-20240426-en
General
-
Target
c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe
-
Size
240KB
-
MD5
d75e3236e471d4aa6a815411ffa047bf
-
SHA1
79da92d124702d91ba2258bfdbdadd25f7855d96
-
SHA256
c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32
-
SHA512
95e02604d0f1451fef19c5edb7d388e2eb7f08666087a524ca1ae610611ecca922880dbb5a88baf30283eeeed0d37f328e4bdf1a577011d09335c0b4f7833fee
-
SSDEEP
6144:VBoXYv1rTTdFB4Tbk2V27e+fbhJAPNADR:XD1rT5vV2W
Malware Config
Signatures
-
Detects executables containing base64 encoded User Agent 3 IoCs
resource yara_rule behavioral1/memory/2480-17-0x0000000010000000-0x000000001004A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent behavioral1/memory/2480-19-0x0000000010000000-0x000000001004A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent behavioral1/memory/2480-22-0x0000000010000000-0x000000001004A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_B64_Encoded_UserAgent -
Blocklisted process makes network request 9 IoCs
flow pid Process 2 2480 rundll32.exe 4 2480 rundll32.exe 6 2480 rundll32.exe 12 2480 rundll32.exe 13 2480 rundll32.exe 14 2480 rundll32.exe 15 2480 rundll32.exe 16 2480 rundll32.exe 17 2480 rundll32.exe -
resource yara_rule behavioral1/files/0x000a000000012286-4.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 1088 xapcexjec.exe -
Executes dropped EXE 2 IoCs
pid Process 1088 xapcexjec.exe 1284 wiseman.exe -
Loads dropped DLL 4 IoCs
pid Process 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe 2480 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wiseman = "C:\\wiseman.exe" wiseman.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\ddhbg\\vdmnrkt.dll\",GetWindowClass" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\w: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2080 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2480 rundll32.exe 2480 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2480 rundll32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2416 c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe 1088 xapcexjec.exe 1284 wiseman.exe 1284 wiseman.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2424 2416 c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe 28 PID 2416 wrote to memory of 2424 2416 c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe 28 PID 2416 wrote to memory of 2424 2416 c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe 28 PID 2416 wrote to memory of 2424 2416 c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe 28 PID 2424 wrote to memory of 2080 2424 cmd.exe 30 PID 2424 wrote to memory of 2080 2424 cmd.exe 30 PID 2424 wrote to memory of 2080 2424 cmd.exe 30 PID 2424 wrote to memory of 2080 2424 cmd.exe 30 PID 2424 wrote to memory of 1088 2424 cmd.exe 31 PID 2424 wrote to memory of 1088 2424 cmd.exe 31 PID 2424 wrote to memory of 1088 2424 cmd.exe 31 PID 2424 wrote to memory of 1088 2424 cmd.exe 31 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 1088 wrote to memory of 2480 1088 xapcexjec.exe 32 PID 2480 wrote to memory of 1284 2480 rundll32.exe 33 PID 2480 wrote to memory of 1284 2480 rundll32.exe 33 PID 2480 wrote to memory of 1284 2480 rundll32.exe 33 PID 2480 wrote to memory of 1284 2480 rundll32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe"C:\Users\Admin\AppData\Local\Temp\c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&c:\xapcexjec.exe "C:\Users\Admin\AppData\Local\Temp\c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2080
-
-
\??\c:\xapcexjec.exec:\xapcexjec.exe "C:\Users\Admin\AppData\Local\Temp\c70e06ce834e6a054e9323daae5eb797da7173696f1bb589430aa392651ecd32.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\ddhbg\vdmnrkt.dll",GetWindowClass c:\xapcexjec.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\wiseman.exe"C:\wiseman.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1284
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD58f242369cf14f2b26ced131d7dd67144
SHA1d4f2f0f3047300ff5f36af6119ad5e109258fcd0
SHA25603505198d487e04a8ec82c627d34e4d9145f211140c4c8793b4461621e6bf6ce
SHA5124516b3fa2f68e64baf166bc7731ba3bb0ca53d36d71ff8fa78b1f211d7c14fc4442af50bd637d0c3f11913583c9c66996101d6e8738592a053e82a78bbd771f5
-
Filesize
71KB
MD510eb9b069e53509dfe5652372437858d
SHA1f5b7b4d4f4afe9439d78f43c1915cb3bd07fc620
SHA256c8c3ce80cc170f0a7a3a1ca9120e8279a3f323604b50478ad81869c4131f6315
SHA5126105b5547aa7754183471d395de4fabda8780b5000db2dc4d799bf3af27fca546a0548e6dcc4f435bee5f39e291cae400d7b8efd0d1d7034d31c4e92891b4051
-
Filesize
240KB
MD5fb5cc8f6b4efd8cd75d8ea2a489d0a30
SHA1b0e79b8b5f287678660b3416f5b45f71d2716fdd
SHA2561da95e6cc8d2a62b7983b8c8a3fb80aa1099190a118e6ef5268ceb2c3b9c1447
SHA512146b5af2ff5b8b911c9c4eeb39bf7d954f40d1baaded2383248e8562a2af808b240515fbfae913f42e5ab97ae0e7a977c6876880525df8f0158bf80637a04b57