bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe
Size

75KB
MD5

ec17f94001ffb40d9d672417bc943731
SHA1

1f77f452e179bead89f44732647e6661bbfaa8c0
SHA256

bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e
SHA512

4f93b4b60be3f9970fd453c3f54a1233b22c2c566ffcf89d395b828b6d2ade393af9d39d0829a7e37ecd2d81fc86ecef4b10241f406c1b7cfd0752e7086a870e
SSDEEP

384:+41DuuOFZyUVpULCgDb2prxVTn24X/m7Q6Al6z+yXpC:fDcZyUpULCgo24T96ayX0

Score

9^/10

evasion

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/memory/2912-0-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00090000000141c0-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3024-5-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/3024-6-0x0000000000400000-0x0000000000413000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2996	attrib.exe

Deletes itself 1 IoCs

pid	Process
2152	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	rwmhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\rwmhost.exe	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe
File opened for modification	C:\Windows\Debug\rwmhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2996	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	28
PID 2912 wrote to memory of 2996	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	28
PID 2912 wrote to memory of 2996	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	28
PID 2912 wrote to memory of 2996	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	28
PID 2912 wrote to memory of 2152	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	31
PID 2912 wrote to memory of 2152	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	31
PID 2912 wrote to memory of 2152	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	31
PID 2912 wrote to memory of 2152	2912	bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2996	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe
"C:\Users\Admin\AppData\Local\Temp\bdb06b3dedef202ca3a3e564a1c789d67c00dce0b0ad96e1f8a0e3a2ee7eaf0e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\rwmhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BDB06B~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2152

C:\Windows\Debug\rwmhost.exe
C:\Windows\Debug\rwmhost.exe
1⤵
- Executes dropped EXE
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\rwmhost.exe

Filesize
75KB

MD5
32ddb474d47145aef8d3847d0dcf1d40

SHA1
91615a314a539132c1e5b5f95b1801d2cb4f7d07

SHA256
d5fbcfe6db3a1264e5dbd1504aeaa050a6fb936913f691fca2cca2809391bfa0

SHA512
a5efc352bab7bb365666c8c2017f923ad8ccb2b5e50844bc3ed68dfd48c9d559c74d2af8fd296ce3775570b35b643d181aaaff543a16e3ac050b1e4f4820bceb

Download Submit
memory/2912-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3024-5-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3024-6-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads