Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe
Resource
win10v2004-20240508-en
General
-
Target
914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe
-
Size
406KB
-
MD5
2ba5bab54464302a968f7f84b1063916
-
SHA1
d489adcaa985967e56bfcdfc4520ddd58324bcae
-
SHA256
914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d
-
SHA512
c4469e007164933c0034d826110faa23abfa416d83c4db5a14ab028e9221a846c10070fe1b9df4d6d3ba83dfb16c5a44d0c10391b39b92551c40514bd31fcac9
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
Malware Config
Signatures
-
Blocklisted process makes network request 8 IoCs
Processes:
rundll32.exeflow pid process 24 1292 rundll32.exe 31 1292 rundll32.exe 32 1292 rundll32.exe 33 1292 rundll32.exe 44 1292 rundll32.exe 45 1292 rundll32.exe 53 1292 rundll32.exe 66 1292 rundll32.exe -
Deletes itself 1 IoCs
Processes:
paaws.exepid process 1740 paaws.exe -
Executes dropped EXE 1 IoCs
Processes:
paaws.exepid process 1740 paaws.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1292 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\gjewlxyxv\\qnaigxcc.dll\",Verify" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\z: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1292 rundll32.exe -
Drops file in Program Files directory 2 IoCs
Processes:
paaws.exedescription ioc process File opened for modification \??\c:\Program Files\gjewlxyxv paaws.exe File created \??\c:\Program Files\gjewlxyxv\qnaigxcc.dll paaws.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe 1292 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1292 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exepaaws.exepid process 4392 914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe 1740 paaws.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.execmd.exepaaws.exedescription pid process target process PID 4392 wrote to memory of 3848 4392 914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe cmd.exe PID 4392 wrote to memory of 3848 4392 914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe cmd.exe PID 4392 wrote to memory of 3848 4392 914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe cmd.exe PID 3848 wrote to memory of 3348 3848 cmd.exe PING.EXE PID 3848 wrote to memory of 3348 3848 cmd.exe PING.EXE PID 3848 wrote to memory of 3348 3848 cmd.exe PING.EXE PID 3848 wrote to memory of 1740 3848 cmd.exe paaws.exe PID 3848 wrote to memory of 1740 3848 cmd.exe paaws.exe PID 3848 wrote to memory of 1740 3848 cmd.exe paaws.exe PID 1740 wrote to memory of 1292 1740 paaws.exe rundll32.exe PID 1740 wrote to memory of 1292 1740 paaws.exe rundll32.exe PID 1740 wrote to memory of 1292 1740 paaws.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe"C:\Users\Admin\AppData\Local\Temp\914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\paaws.exe "C:\Users\Admin\AppData\Local\Temp\914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\paaws.exeC:\Users\Admin\AppData\Local\Temp\\paaws.exe "C:\Users\Admin\AppData\Local\Temp\914b18e7de7a1c656ee7c42b92ae49f2a647c4a025636af92373214634c0ac3d.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\gjewlxyxv\qnaigxcc.dll",Verify C:\Users\Admin\AppData\Local\Temp\paaws.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\paaws.exeFilesize
406KB
MD5c72548a523c62a387a25c99a039e235c
SHA14653754d4c5f5f98a5ca7854f3b107bf7d502c06
SHA256c7b6542917c3ed017cbd953f12853ba144010ace82ff10fd736aeb9ccc86c4d3
SHA512004103bcbe081fab7a41d46c87aefb2c909b56dd1aa25bfd7bb981a0c4bd73e3e9518ae64d0024e7805b8c6bf2e5f32d5ded056de2a739bc0cfe625fdfb93fa4
-
\??\c:\Program Files\gjewlxyxv\qnaigxcc.dllFilesize
228KB
MD596b3c49e74878c0a97a340edefdaef5c
SHA193d3e8dd8e6813488a245298f457fcce330f7799
SHA25627dad98ebe65013df61e9e56148038cbae539788d488e3ebb0c3619830a55021
SHA512d04f7b49a91299bef98c7647b8f944255df995db60960ec2aa9970f9103328f6634e46e15e8db85dd9453e507309398623a42005a65bfcbf2ae4e031861d8c38
-
memory/1292-10-0x0000000010000000-0x0000000010080000-memory.dmpFilesize
512KB
-
memory/1292-11-0x0000000010000000-0x0000000010080000-memory.dmpFilesize
512KB
-
memory/1292-13-0x0000000010000000-0x0000000010080000-memory.dmpFilesize
512KB
-
memory/1740-7-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/4392-0-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/4392-2-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB