ce9955c91d6a5f9e211ecb80cc51d8025eccfe4e1398947c094c94a6e2904f18

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe
Size

1.1MB
MD5

805fab0520813f1daf4cbaa9fed21d46
SHA1

209a066865bcf0daae7ec4460d26bc20ea4d6eaa
SHA256

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b
SHA512

7f561ac50b702e66d983cb35ecee637b6481956cb254e71990b5d6db5cd9fd08044015e6483ad46d39d39177f8a566eee4ec1d37c2f84fe99ad65bdd037e3217
SSDEEP

24576:OyCh/1QpnUZKnb8nOaEt0M7JQWXZVbtrwcwRhadKLT:dIUxL0qucwcwRhad

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

Processes:

TA0uZ8pS.exeLU7Ng5Gw.exehQ5SB7vc.exezp6le0rt.exe1JX71RM7.exe

pid process

3056 TA0uZ8pS.exe
4040 LU7Ng5Gw.exe
216 hQ5SB7vc.exe
2580 zp6le0rt.exe
4668 1JX71RM7.exe

pid	process
3056	TA0uZ8pS.exe
4040	LU7Ng5Gw.exe
216	hQ5SB7vc.exe
2580	zp6le0rt.exe
4668	1JX71RM7.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exeTA0uZ8pS.exeLU7Ng5Gw.exehQ5SB7vc.exezp6le0rt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	TA0uZ8pS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	LU7Ng5Gw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hQ5SB7vc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	zp6le0rt.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exeTA0uZ8pS.exeLU7Ng5Gw.exehQ5SB7vc.exezp6le0rt.exe

description	pid	process	target process
PID 100 wrote to memory of 3056	100	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe	TA0uZ8pS.exe
PID 100 wrote to memory of 3056	100	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe	TA0uZ8pS.exe
PID 100 wrote to memory of 3056	100	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe	TA0uZ8pS.exe
PID 3056 wrote to memory of 4040	3056	TA0uZ8pS.exe	LU7Ng5Gw.exe
PID 3056 wrote to memory of 4040	3056	TA0uZ8pS.exe	LU7Ng5Gw.exe
PID 3056 wrote to memory of 4040	3056	TA0uZ8pS.exe	LU7Ng5Gw.exe
PID 4040 wrote to memory of 216	4040	LU7Ng5Gw.exe	hQ5SB7vc.exe
PID 4040 wrote to memory of 216	4040	LU7Ng5Gw.exe	hQ5SB7vc.exe
PID 4040 wrote to memory of 216	4040	LU7Ng5Gw.exe	hQ5SB7vc.exe
PID 216 wrote to memory of 2580	216	hQ5SB7vc.exe	zp6le0rt.exe
PID 216 wrote to memory of 2580	216	hQ5SB7vc.exe	zp6le0rt.exe
PID 216 wrote to memory of 2580	216	hQ5SB7vc.exe	zp6le0rt.exe
PID 2580 wrote to memory of 4668	2580	zp6le0rt.exe	1JX71RM7.exe
PID 2580 wrote to memory of 4668	2580	zp6le0rt.exe	1JX71RM7.exe
PID 2580 wrote to memory of 4668	2580	zp6le0rt.exe	1JX71RM7.exe

C:\Users\Admin\AppData\Local\Temp\c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe
"C:\Users\Admin\AppData\Local\Temp\c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TA0uZ8pS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TA0uZ8pS.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LU7Ng5Gw.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LU7Ng5Gw.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hQ5SB7vc.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hQ5SB7vc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zp6le0rt.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zp6le0rt.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JX71RM7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JX71RM7.exe
        6⤵
        Executes dropped EXE
        
        PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TA0uZ8pS.exe

Filesize
1.0MB

MD5
8e56ad3e7626b33b61786b2921afa11c

SHA1
6d5c6e87aec120834f324664692b6c073f184510

SHA256
b56ab7f4f7977c68f371fc0fa6a32db37e38efce96a229a894d7a5b138b962c4

SHA512
b80356df83c6442448b62c40f3720cbf797096a631ddb9c2e8ebf613caec812e4a962553988fe909b0676862c09bdb73c85826cea93642db5a66b335c3365b09

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LU7Ng5Gw.exe

Filesize
844KB

MD5
521614794d1f10f1d03bd2f1408ebabe

SHA1
8f597079e5ed3315837d282334374542fcb06931

SHA256
f80fe0908a94a0bfb3cf3c304c931d5f8ce593f759b28abc5b9047af23e9cf7b

SHA512
9cdef3edbb9aa91b17badad45a4909f2c81a9a852a92282a445e56f30b30076928311bce7dc7b95e4b6e062e1d487b702aabb4b02ab17c0e66ce1b2ed45604ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hQ5SB7vc.exe

Filesize
593KB

MD5
6ed5ae9a75d6c0fc57086f9ab4371a20

SHA1
df94b083ae386775b62d602bc46252d4331f98a6

SHA256
cba59ce33be89d23e609afec0a1524d0d702d9d3fc3e13245b0638c93ca062f0

SHA512
23c30dfb149df017b7957fb59740807c8aa7f7326647061e5465cfb1faad05212b0021f410197d1fcb2000476e4df4bec3203a0ff56e34ae45ddf095f8aa2507

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zp6le0rt.exe

Filesize
398KB

MD5
61573360f6f8f9eef48a0f8054af8a8c

SHA1
414cf2050e7ffafeba37c62a8a553e18b3e97e14

SHA256
22b69144bd7d463b8084a91a5d296c1dbdf270abf12df328be19b72f49bb0ccf

SHA512
5629c12c9ed4c591ac9ac618b6be741ee2bec9edf18561d12ae3a94f7a3849939c6bef72f3c7039d9f944a3382b1ecfa2fff007e05787105849ae3b6985dd6da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JX71RM7.exe

Filesize
320KB

MD5
058c82cf21c2d1da30146d61436aab48

SHA1
8fb443d6edc6267d8ee9a76b2ed002a4bc401413

SHA256
665dcca8deea4344514ffc018fc4b3997567f7189532b9e30ac89035137cbc05

SHA512
38a0227a33b93434f61ebbfac6da78950c98fbac30a4e26e2900807552e37fab0ef8f6cda6f4d74aaf1464153f4da4b70580f5d75afdb73219633f9817229dd4

Download Submit