ce9a42636d4eaf09a292ccccc80d226e2f8eee88f6e08ad7752ef4f07c6b5fe7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dx81nteng.exe
Size 7.5MB
Sample240602-2y8ljaac2v
SHA256 ce9a42636d4eaf09a292ccccc80d226e2f8eee88f6e08ad7752ef4f07c6b5fe7
MD5 7f4a53f9a02389c58cbc48b0eb051b46
SHA1 f6677cb45e54c5239c8e739a83b8086758615e8f
SHA512 faf1829d6bc31fea70f9e11c071cf671823a686bae9992f452cee68dca3cacc9991521fa843d0d171dbec07a123f2546fcf75a8195cdf8550a802e53fc4fa53a
SSDEEP 196608:28UamJJ5qQqGMgrntkzxZ/Vi6mjWvoGOU5fHS40s8:28UamJXxqb0qjVievh15fy40s8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1312	DXSetup.exe

Loads dropped DLL 4 IoCs

pid	Process
1312	DXSetup.exe
1312	DXSetup.exe
1312	DXSetup.exe
1312	DXSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dx81nteng.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Directx.log	DXSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1312	1500	dx81nteng.exe	92
PID 1500 wrote to memory of 1312	1500	dx81nteng.exe	92
PID 1500 wrote to memory of 1312	1500	dx81nteng.exe	92

C:\Users\Admin\AppData\Local\Temp\dx81nteng.exe
"C:\Users\Admin\AppData\Local\Temp\dx81nteng.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXSetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXSetup.exe /packageinstall
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DSETUP32.DLL
Size 201KB
SHA256 f0a0c868c235b64b0660abbfb99e6144f6b88b09b47388c98591b245d37525cd
MD5 505e78e616b34c7749a4905851b48135
SHA1 596215f6578521f6b45088b8b76742d75dc78443
SHA512 45901e87a47a4a3d9ef2691b012d36d468feb5fe71634bbedecfa4f6fe81ada652548690f333c562ef23865bc435013d78720f1a21bd0bfc1f086cd713fc1992
SSDEEP 6144:QKmAi0h47A8Z8lwK3a+svRk3jYl73VbYT5X:j4RZmla5MYl7tU
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
Size 34KB
SHA256 e7a0b03d443bfface5e6cbdb3ebf3ee8eb35790a07cc50860bd68a32f56d0b61
MD5 90a83f5d49fbcb83bc1736b865ea1f06
SHA1 e1991e68b621d8e958df75c6caa74b4d268e0cf1
SHA512 f9f627bf67e369d9c8ef6e4bcff0069a88305c6f5bd2b246b05e076fad20cb05ca6b4db89758d506bba98eecbc5e6d81caa36d6f0eec1812b433a516a5fa48e9
SSDEEP 768:fM0v+mWosSeNwRQy1E5MYDgZBC7Q3+jPJrEDURH:fPbRzeNwp25MY8nC83+LJrEDgH
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxsetup.exe
Size 46KB
SHA256 b67c0758ce37c751a96a36f97c1a0079c70ada85ca5d0a712bf2b96459c98d63
MD5 0b920036cdbebab87c9b786e518fc423
SHA1 09119b938dac962fc9b810e22d27932885c1f030
SHA512 898fc449ff3fc03fef6de4b5f4b524f66af024ba180528fda989a2a177785b191cfa2ed4859792529dca22cc58b3d953fabf3ceb5d02fdd64b8c8c97484c692e
SSDEEP 768:Nxna0+m5KmAeWj1ciacV9yo7gMEexX7C0tF4nB/NsJHhcE3:DpCmAeWjDN7lEexX75tF4BFsJHhc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1312-576-0x0000000000490000-0x000000000049C000-memory.dmp

Download

memory/1312-581-0x00000000005C0000-0x00000000005F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads