Malware Analysis Report

2025-08-10 21:28

Sample ID 240527-w5mpradd2z
Target 06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec
SHA256 06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec
Tags
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec

Threat Level: Shows suspicious behavior

The file 06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec was found to be: Shows suspicious behavior.

Malicious Activity Summary


Deletes itself

Executes dropped EXE

Loads dropped DLL

Uses the VBS compiler for execution

Checks computer location settings

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 18:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 18:30

Reported

2024-05-27 18:32

Platform

win7-20240221-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2136 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2136 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2136 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2136 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 2320 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2320 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2320 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2320 wrote to memory of 2584 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 2136 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe
PID 2136 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe
PID 2136 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe
PID 2136 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe

"C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\khbuodu4\khbuodu4.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E0C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6BEBB17E929242009B852A1D383D1CA5.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe" C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe

Network

N/A

Files

memory/2136-1-0x0000000001320000-0x000000000132A000-memory.dmp

memory/2136-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\khbuodu4\khbuodu4.cmdline

MD5 d9d6b70905a112398aa0ce74fd50b91e
SHA1 e57e377640de000f0aa123825dba1d53757295bc
SHA256 379ee9b4442eaaa59995013ed2eb8a9aeacaaca1bd55f3b8fd38d4d2c6975f5f
SHA512 591954c8d61770ce5acfe0ab9a768fc3c43a77a59f5e7be88b036591794f9ba306d79b6bc9fb95c156c56a32a91ad9845e42efb92ce9964e97af2c1e83ad7856

memory/2136-7-0x0000000074B60000-0x000000007524E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\khbuodu4\khbuodu4.0.vb

MD5 3435a517505f78579db858338e9f1502
SHA1 fba6eeacea768366641bfdc3270bfa226276e59e
SHA256 0adafdf0f6f94dab872a1dc17063c8c6020948fc422fc9ce7191915a7f15fd6c
SHA512 32b28cc1e91e8ef7e5ab31755c34463b535545902f0dbba9a0dc5ff3f728773a03c1739af9636a47688efe043ef9940dad64f39c8d9db326ee832ba52556cd73

C:\Users\Admin\AppData\Local\Temp\vbc6BEBB17E929242009B852A1D383D1CA5.TMP

MD5 980f39b941a8d439652c491f80f53dfb
SHA1 7970df85835353d57dc50a99e4ff48153cbd7940
SHA256 9c1a14a1c206666bf6509251dffe54e234d819116abee3365adc748ae080a2b1
SHA512 94ce7bfc1e1e5cdcaa0fadb1ce69ad2016ccaadcbd28f6eea1aa3663d3d1b5e0fffffdf88810a6be8085d62dfe930ec59b058026afdce31826ca6703ac52a8af

memory/2536-23-0x0000000001370000-0x000000000137A000-memory.dmp

memory/2136-24-0x0000000074B60000-0x000000007524E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1C87.tmp.exe

MD5 6e5bc10f871fea640ecc4211db63cf24
SHA1 13ed2a500cd1922982b5fc566dd67da2896d8486
SHA256 7944e78ec8e0dbb1706bf8665bfeb493b856524bc5d9babe50fd2621048ce685
SHA512 86d2ea3c43d73e2a413dee288ab2bc496273a6cb6dc77354512c021a95e9f0723fb85c9d03d89db11999c7c326674fe5fe57b09aa641798638b0c4c9456ed5f2

C:\Users\Admin\AppData\Local\Temp\RES1E0C.tmp

MD5 7037789814c5743ac7b830e65cc5c8d7
SHA1 7a8490451b4e42b78abfbd7832c8307807a13a15
SHA256 722b2c9d5b5bce76221b64049233566a87f5ece3d462716455498d8072b70925
SHA512 113bf91e028d0d4db08dc833c1821a48b46976343c8dd00f31747ffa1b42e8d7cef24b361f420acf30b1a6b0279939bad1b1c3b37643b034947b2dbf53d94a94

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 6d6f6e3f42f44836003a4e59c6821534
SHA1 821db764008bddddcf848c15a84717766300fd56
SHA256 cd09ddb9e90f574d8e0eab5e38faea4c5bafc3b99ed55e24d65e8547ec85ade9
SHA512 d6b2a8070c4604b0853ee0045903123b17fb7fc6fba8cacb77cda6a0e169170d951e891ed8c1ef1c63f197a08dd9b2f98e236eb800b3b77adc68ccea9611193c

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 18:30

Reported

2024-05-27 18:33

Platform

win10v2004-20240226-en

Max time kernel

142s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 956 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 956 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 956 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 220 wrote to memory of 3288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 220 wrote to memory of 3288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 220 wrote to memory of 3288 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 956 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe
PID 956 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe
PID 956 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe

"C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\l2lrccfh\l2lrccfh.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8855.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc95BA6CA08DD34040B28C7974DF04288.TMP"

C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe

"C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe" C:\Users\Admin\AppData\Local\Temp\06aa5b00daefd22f99f24d794178a50212fd57a76f7084610af6cf98db766dec.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5240 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/956-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

memory/956-1-0x0000000000050000-0x000000000005A000-memory.dmp

memory/956-2-0x0000000004A90000-0x0000000004B2C000-memory.dmp

memory/956-7-0x0000000074EE0000-0x0000000075690000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\l2lrccfh\l2lrccfh.cmdline

MD5 fbf6b0510770834eaa24a1797f7be207
SHA1 d2650c4ae592e2d3d2f88dae9711cdec73666de8
SHA256 e7051ec5e95518bf4c92f237a9d09904b2344a3cf8e02f2d7aa66c28b9743b0f
SHA512 c42f9d728f6651657946a9c174a4d6b1b770e08e3e0a1cca8a7c6fdc723d334bdf7d794b291b57f61abdd270ec0e6658cea6bc11c22e8ed7d8cccf45f5352245

C:\Users\Admin\AppData\Local\Temp\l2lrccfh\l2lrccfh.0.vb

MD5 d1d41b41635c27a39a4ce224a34576e6
SHA1 72efdad2ccea7f3c1ab98a59d4f9fffa68dead8e
SHA256 718d73da66e72c512ad900bb30a4b3544bf462ee8a14ac10191040e2d134cb9a
SHA512 f0aaa9156394ac3fef2b569299cf4db522327c647dc90728ad95dbf4b2fa878f545b1ea951a69f883698cf87c854fa3fd764fd002405b7e11da82db6af04baf6

C:\Users\Admin\AppData\Local\Temp\RE.resources

MD5 52627d163bf47398918c344c0f486765
SHA1 5c6d1e4884aa1c65e3b2f8c52efab110ebd22040
SHA256 67360b0661c53bb2dabe317ece26d065ea34266543e1b2f105b632f85cfcd5bd
SHA512 488b86a1d59b514ee4adabeadac26f925405bebb97101c5f78bf1dfaf3f6b6534f4f54fb8636b6e6a2ef69f22436b601e11b6f40893127f2780a3ca0c1503d9e

C:\Users\Admin\AppData\Local\Temp\vbc95BA6CA08DD34040B28C7974DF04288.TMP

MD5 cda0ad7d391345e13af12857fb3aafe4
SHA1 5d03b181c1f8f08a3ab309b395628cfb68a3b673
SHA256 f157cfb51bbffc2cf0b8a7ca222303afb20fe9a150230ba94fcc6495fb964545
SHA512 c0d931df1407442750e073a22c4624cc28652e2a452858db6e63c091e7cd4feb47dd701203c2a2e2d56235ebc6ab343641cb3731fb4d302b442356d456a1c26b

C:\Users\Admin\AppData\Local\Temp\RES8855.tmp

MD5 5f0c0ff14fd49a8ac6d0b9e08470ab38
SHA1 8488f70d4bcd449d4017cec928b0c75830195747
SHA256 88b5292e614fa5ae6d7df34722fa3e301df4c9448625059a4077d8f3c548bdcb
SHA512 d4f0331d87d069a24c9316d0f8a5fbcb2b12bead647d097ecb58a47d4078199f7bb1e5a9f464bd4ffe2a48dc967f8a6069c1f2a91a8714c06ef9f6b2f8ac2c2a

C:\Users\Admin\AppData\Local\Temp\tmp6F50.tmp.exe

MD5 a3bccb9b16e908af8435d2daa048c8ff
SHA1 d4fbef098d5cea233713903b0174d80e90385a0e
SHA256 3e0cef46b60b72b49c7e44ff7f84007e786f53b0be84611b9cb0cea0bd61e78d
SHA512 184a50c471d6dfde5ea8061f76927d16236df7b16586bacf4f3e4ec3fcb52a896a125fbcf72aa2d9bd748e89baabdbe8a007419cc6f2cb1ec7a9544486dc0e6c

memory/956-22-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

memory/3228-25-0x0000000000C40000-0x0000000000C4A000-memory.dmp

memory/3228-26-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/956-27-0x0000000074EE0000-0x0000000075690000-memory.dmp

memory/3228-28-0x0000000005B00000-0x00000000060A4000-memory.dmp

memory/3228-29-0x00000000055F0000-0x0000000005682000-memory.dmp

memory/3228-31-0x0000000074EE0000-0x0000000075690000-memory.dmp