bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe
Size

410KB
MD5

37127fb6ebd2593a6af92fe28d308a06
SHA1

b570b64a5b1c30870cec478584ced71395bbef91
SHA256

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b
SHA512

210d1dd6a1e04ae4fdb9e67c762624c23ef17145568b5b4c658de60ca43e3d2856cd33ea9a74b7aea49e1a1e91b37e2cda7af762b4770a5b579fc1cb79f456e5
SSDEEP

6144:6BxIK3CTW8TMjp41u6nyHwnZA9B8/H4QwRHLZ2L+az+bLdHGwbnLiMCfhepOD3nA:CxIK9V14ImyHY+B6HhCoDQ

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rkgjwm.exe

pid process

4480 rkgjwm.exe

pid	process
4480	rkgjwm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rkgjwm.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\rkgjwm.exe"	rkgjwm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe

description	pid	process	target process
PID 4284 wrote to memory of 4480	4284	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	rkgjwm.exe
PID 4284 wrote to memory of 4480	4284	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	rkgjwm.exe
PID 4284 wrote to memory of 4480	4284	bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe	rkgjwm.exe

C:\Users\Admin\AppData\Local\Temp\bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe
"C:\Users\Admin\AppData\Local\Temp\bad643dbd36ccd0cfd695756eb680401fd0ba76d6fac40e7004f029fe85d476b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284

C:\ProgramData\rkgjwm.exe
"C:\ProgramData\rkgjwm.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3928 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DumpStack.log.tmp .exe
Filesize
410KB

MD5
e7512e27cba9283e57b1992608f6f8f7

SHA1
432831b868646a88297a2440d4caa575a26eea0a

SHA256
1e8eac18346a305eadc7be5e3f6963879c433e407deda47aedcaf3e9fde98374

SHA512
0af9021efe086575ee5f7558e7140cb9370902f9257ab570d921b803fd849406b7985a7c96f07544551a71ca6eb9522cfc3b64728784f147facdb8078468c953

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
150KB

MD5
aef10b9ba25f907727558514f2dfbab0

SHA1
d67383ef1b23d4da72339d66de9541c2e1efaf53

SHA256
f5e77ddc706f6dffe056dc2f8a88adece36e0e4552bc70a85f36b1e01fe547ad

SHA512
5e607a70ca3fa489897f8df0c96570709839364cd8cabd5f76386dfff01ca2986d50c120cf82926dff950c7d7b6ec833ea7558b64ec8f0dfe2e5070abf1da103

Download Submit
C:\ProgramData\rkgjwm.exe
Filesize
259KB

MD5
7b069b21a3fbd90b64c191c8cfb34185

SHA1
2a29adaf19c95048425cb74d34bb9afe63008f68

SHA256
1d4c4a206c14038c14b82bbe0a8f216490f093bafa772a5d1db31e316e0deec9

SHA512
9c12233993213091580b1dfe2f5cbda1218e352e513d163ab5653de3f0423ee1827e051e2a42003ae11cc8512510750513db2df4b48d1b9d8e41dc1478e544be

Download Submit
memory/4284-0-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4284-1-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4284-9-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4480-72-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download