1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8.exe
Size 704KB
Sample240601-xtvfwscg97
SHA256 1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8
MD5 528ea6abf3f44116aaaf401259cd05f3
SHA1 b6767460282769af351ac9072ddfe294bd6e13a4
SHA512 91a887355e2485cd1b76c45671a1d3b9cd5a19517af22ac9465e2f9873a2c17a8d9fa8f1dbe008aab19fbefa42573679e0c98c38e52a53feeca61f979c8d3c93
SSDEEP 6144:4jlYKRF/LReWAsUy67r1Y8yxY/84k3UXka/a1tRFP8u8TEBdEtdjf9d/nAOyg87g:4jauDReW8FC8XkaSjETlthC+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3248	xbkbt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\xbkbt.exe"	xbkbt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3248	4236	1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8.exe	83
PID 4236 wrote to memory of 3248	4236	1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8.exe	83
PID 4236 wrote to memory of 3248	4236	1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8.exe	83

C:\Users\Admin\AppData\Local\Temp\1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8.exe
"C:\Users\Admin\AppData\Local\Temp\1b381a251dbea138a44d781c763ef6b1a721b3dc50243c86cbb750ebac4ec9e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4236
- C:\ProgramData\xbkbt.exe
  "C:\ProgramData\xbkbt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Documents and Settings .exe

Path C:\Documents and Settings .exe
Size 704KB
SHA256 a388101a0ed87502782697c429fb7fdd3c42f96d01329cb2261586ecd00ef8c7
MD5 da812b732ba41c206c09b9935348ca71
SHA1 c6a7a3c2176357118403c3c348092179a1dc5a03
SHA512 9df3362b7bc0ea005ebb55609a7cd78fff22329e70eaaf4fe54c28078ef42c745001f32b30ffb8b170d472e01d9770f0d00951a62c3bcf8f916bbdca3a9c6297
SSDEEP 12288:4jauDReWMkV9c1/fTPbXbmuyeaqurutG/kiaTf5wSYzkBC2efV6CwHLSwiCbZnhl:4DDQc96TPjbmuyenurutG/kiaTf5wSYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mira.h

Path C:\ProgramData\Saaaalamm\Mira.h
Size 136KB
SHA256 f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
MD5 cb4c442a26bb46671c638c794bf535af
SHA1 8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA512 074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3
SSDEEP 1536:8fjj+VDJ2Y1XJ2xH7Z3CPRs/sYuQrR7qKFFdr8uveDgK2FgGdFXCFnsUo6Ge/ASC:EjjSMY1XoRCP+/33rReWIVZvFsU5Ja
MD5 SHA1 SHA512 SSDEEP

Submit Download

xbkbt.exe

Path C:\ProgramData\xbkbt.exe
Size 567KB
SHA256 1c549e16cfe6b7fc53f3f66610e9cbd508b2682c2510aa4bd34b1d6cd9a602c5
MD5 8f6acedd602d4e4ee321d258307829e7
SHA1 277b206e3035c0231a8437340ddb44ea66e31515
SHA512 3d44296dc254c2015b9dfb217c036d7f3f358bcd288b5018c0f24d79a8319f32bb5fa3c5054e6b9b56e0b5220e5075b1b8253df1f61f8f125582e803dd96a72a
SSDEEP 12288:Pjwqr+D5V4EwO6Fz0sK+oPmG9jnbGYqvAYokDvdUC1TgwyhsCC+6fn5YIBethjc4:rwqr+D5V4poPmG5bZCFfn5YIBethjcuX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3248-130-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4236-0-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4236-1-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4236-9-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads