Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77810.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
77810.exe
-
Size
94KB
-
MD5
f93b32527bf4a3336aaf723e3843e167
-
SHA1
1eff6bc9d4071208e5c27e3d888b841b77821504
-
SHA256
773dba4375f27e9444e7c51755b6d070d3c18fce223e5a52d37f173563b16290
-
SHA512
e32e08a55b188b40ee0c4de9b823a6d176323c6a99c9522869d4350eaaa5c068a99dc9d38f1c850f043ade9518f30e31f4dc25c0adf403deb74382a97e6d8c05
-
SSDEEP
1536:WnnFGOHtnmJXRDB3EZTz71YvUAGjztobIu+Vh/QRFBAw1:WTYXRgbjCbb+D/QRFBZ
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
Processes:
channelmheg.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 channelmheg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE channelmheg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies channelmheg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 channelmheg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
channelmheg.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix channelmheg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" channelmheg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" channelmheg.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
77810.exe77810.exechannelmheg.exechannelmheg.exepid process 1000 77810.exe 1000 77810.exe 624 77810.exe 624 77810.exe 4928 channelmheg.exe 4928 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe 336 channelmheg.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
77810.exepid process 624 77810.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
77810.exechannelmheg.exedescription pid process target process PID 1000 wrote to memory of 624 1000 77810.exe 77810.exe PID 1000 wrote to memory of 624 1000 77810.exe 77810.exe PID 1000 wrote to memory of 624 1000 77810.exe 77810.exe PID 4928 wrote to memory of 336 4928 channelmheg.exe channelmheg.exe PID 4928 wrote to memory of 336 4928 channelmheg.exe channelmheg.exe PID 4928 wrote to memory of 336 4928 channelmheg.exe channelmheg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77810.exe"C:\Users\Admin\AppData\Local\Temp\77810.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\77810.exe"C:\Users\Admin\AppData\Local\Temp\77810.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:624
-
C:\Windows\SysWOW64\channelmheg.exe"C:\Windows\SysWOW64\channelmheg.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\channelmheg.exe"C:\Windows\SysWOW64\channelmheg.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-28-0x00000000006F0000-0x0000000000700000-memory.dmpFilesize
64KB
-
memory/336-32-0x00000000006D0000-0x00000000006DD000-memory.dmpFilesize
52KB
-
memory/336-22-0x00000000006E0000-0x00000000006ED000-memory.dmpFilesize
52KB
-
memory/336-26-0x00000000006E0000-0x00000000006ED000-memory.dmpFilesize
52KB
-
memory/336-27-0x00000000006D0000-0x00000000006DD000-memory.dmpFilesize
52KB
-
memory/624-12-0x0000000000590000-0x000000000059D000-memory.dmpFilesize
52KB
-
memory/624-7-0x00000000005A0000-0x00000000005AD000-memory.dmpFilesize
52KB
-
memory/624-11-0x00000000005A0000-0x00000000005AD000-memory.dmpFilesize
52KB
-
memory/624-30-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/624-31-0x0000000000590000-0x000000000059D000-memory.dmpFilesize
52KB
-
memory/624-13-0x0000000000A40000-0x0000000000A50000-memory.dmpFilesize
64KB
-
memory/1000-0-0x00000000009D0000-0x00000000009DD000-memory.dmpFilesize
52KB
-
memory/1000-14-0x00000000009D0000-0x00000000009DD000-memory.dmpFilesize
52KB
-
memory/1000-1-0x0000000002190000-0x000000000219D000-memory.dmpFilesize
52KB
-
memory/1000-5-0x0000000002190000-0x000000000219D000-memory.dmpFilesize
52KB
-
memory/1000-6-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/4928-19-0x00000000008F0000-0x00000000008FD000-memory.dmpFilesize
52KB
-
memory/4928-29-0x0000000000550000-0x000000000055D000-memory.dmpFilesize
52KB
-
memory/4928-20-0x0000000000550000-0x000000000055D000-memory.dmpFilesize
52KB
-
memory/4928-21-0x0000000000900000-0x0000000000910000-memory.dmpFilesize
64KB
-
memory/4928-15-0x00000000008F0000-0x00000000008FD000-memory.dmpFilesize
52KB