Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 14:33
Behavioral task
behavioral1
Sample
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe
Resource
win10v2004-20240426-en
General
-
Target
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe
-
Size
1.1MB
-
MD5
9ffd1931c316b882683d87dd1050d8e3
-
SHA1
9d07ec6e678af5606870436e270f9aceb42a1f15
-
SHA256
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b
-
SHA512
20b2a0f23bfb5f6de06a2bb93a8262a934c8870e8ba1dc19e9028822dda6390aec92889440950150434af231e56bf242902fd06ad72e3423529af863b809e11d
-
SSDEEP
24576:U5AM2KZA9dG+SbJoDWW3eDoBbbT9LNDigHb2WyTUZ0ed2jaQFjZuj4R:UEm+RaW0oRJLNR729TZecjJFVu0R
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3012-9-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-10-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-12-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-17-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-18-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-19-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-23-0x0000000000400000-0x0000000000702000-memory.dmp upx behavioral1/memory/3012-28-0x0000000002130000-0x0000000002191000-memory.dmp upx behavioral1/memory/3012-30-0x0000000002130000-0x0000000002191000-memory.dmp upx behavioral1/memory/3012-31-0x0000000000400000-0x0000000000702000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
dialer.exedescription ioc process File opened for modification \??\PhysicalDrive0 dialer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exedescription pid process target process PID 2128 set thread context of 3012 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe dialer.exe -
Drops file in Windows directory 1 IoCs
Processes:
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exedescription ioc process File created C:\Windows\1008671.txt c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exedialer.exepid process 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe 3012 dialer.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exedialer.exedescription pid process Token: SeDebugPrivilege 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe Token: SeDebugPrivilege 3012 dialer.exe Token: 1 3012 dialer.exe Token: SeCreateTokenPrivilege 3012 dialer.exe Token: SeAssignPrimaryTokenPrivilege 3012 dialer.exe Token: SeLockMemoryPrivilege 3012 dialer.exe Token: SeIncreaseQuotaPrivilege 3012 dialer.exe Token: SeMachineAccountPrivilege 3012 dialer.exe Token: SeTcbPrivilege 3012 dialer.exe Token: SeSecurityPrivilege 3012 dialer.exe Token: SeTakeOwnershipPrivilege 3012 dialer.exe Token: SeLoadDriverPrivilege 3012 dialer.exe Token: SeSystemProfilePrivilege 3012 dialer.exe Token: SeSystemtimePrivilege 3012 dialer.exe Token: SeProfSingleProcessPrivilege 3012 dialer.exe Token: SeIncBasePriorityPrivilege 3012 dialer.exe Token: SeCreatePagefilePrivilege 3012 dialer.exe Token: SeCreatePermanentPrivilege 3012 dialer.exe Token: SeBackupPrivilege 3012 dialer.exe Token: SeRestorePrivilege 3012 dialer.exe Token: SeShutdownPrivilege 3012 dialer.exe Token: SeDebugPrivilege 3012 dialer.exe Token: SeAuditPrivilege 3012 dialer.exe Token: SeSystemEnvironmentPrivilege 3012 dialer.exe Token: SeChangeNotifyPrivilege 3012 dialer.exe Token: SeRemoteShutdownPrivilege 3012 dialer.exe Token: SeUndockPrivilege 3012 dialer.exe Token: SeSyncAgentPrivilege 3012 dialer.exe Token: SeEnableDelegationPrivilege 3012 dialer.exe Token: SeManageVolumePrivilege 3012 dialer.exe Token: SeImpersonatePrivilege 3012 dialer.exe Token: SeCreateGlobalPrivilege 3012 dialer.exe Token: 31 3012 dialer.exe Token: 32 3012 dialer.exe Token: 33 3012 dialer.exe Token: 34 3012 dialer.exe Token: 35 3012 dialer.exe Token: 36 3012 dialer.exe Token: 37 3012 dialer.exe Token: 38 3012 dialer.exe Token: 39 3012 dialer.exe Token: 40 3012 dialer.exe Token: 41 3012 dialer.exe Token: 42 3012 dialer.exe Token: 43 3012 dialer.exe Token: 44 3012 dialer.exe Token: 45 3012 dialer.exe Token: 46 3012 dialer.exe Token: 47 3012 dialer.exe Token: 48 3012 dialer.exe Token: SeDebugPrivilege 3012 dialer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
dialer.exepid process 3012 dialer.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
dialer.exepid process 3012 dialer.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exedialer.exepid process 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe 3012 dialer.exe 3012 dialer.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exeDwm.exedescription pid process target process PID 2128 wrote to memory of 1188 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe Dwm.exe PID 1188 wrote to memory of 2984 1188 Dwm.exe prevhost.exe PID 1188 wrote to memory of 2984 1188 Dwm.exe prevhost.exe PID 1188 wrote to memory of 2984 1188 Dwm.exe prevhost.exe PID 1188 wrote to memory of 2984 1188 Dwm.exe prevhost.exe PID 2128 wrote to memory of 1188 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe Dwm.exe PID 1188 wrote to memory of 3012 1188 Dwm.exe dialer.exe PID 1188 wrote to memory of 3012 1188 Dwm.exe dialer.exe PID 1188 wrote to memory of 3012 1188 Dwm.exe dialer.exe PID 1188 wrote to memory of 3012 1188 Dwm.exe dialer.exe PID 2128 wrote to memory of 3012 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe dialer.exe PID 2128 wrote to memory of 3012 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe dialer.exe PID 2128 wrote to memory of 3012 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe dialer.exe PID 2128 wrote to memory of 3012 2128 c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe dialer.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe 1008610086712⤵PID:2984
-
C:\Windows\SysWOW64\dialer.exeC:\Windows\SysWOW64\dialer.exe 1008610086712⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3012
-
C:\Users\Admin\AppData\Local\Temp\c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe"C:\Users\Admin\AppData\Local\Temp\c28ed60c480b4bcef1f83334b56df25f4ac95db92fe150030d7fd2f12b05183b.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-1-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1188-2-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1188-3-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1188-4-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1188-5-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/1188-32-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/3012-17-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-24-0x0000000010000000-0x000000001003C000-memory.dmpFilesize
240KB
-
memory/3012-12-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3012-9-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-18-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-19-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-10-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-23-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-28-0x0000000002130000-0x0000000002191000-memory.dmpFilesize
388KB
-
memory/3012-29-0x0000000002F20000-0x0000000003021000-memory.dmpFilesize
1.0MB
-
memory/3012-30-0x0000000002130000-0x0000000002191000-memory.dmpFilesize
388KB
-
memory/3012-31-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB
-
memory/3012-6-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB