Analysis
-
max time kernel
9s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 06:56
Behavioral task
behavioral1
Sample
d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe
Resource
win10v2004-20240508-en
General
-
Target
d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe
-
Size
276KB
-
MD5
2b9fd36ce5bc5df7ff7a597eae7acd01
-
SHA1
f9dc9b46a8055dcc91821dad72460dca228a9989
-
SHA256
d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4
-
SHA512
a705f59abedb1f0ee3a5935113d0735e97e38d3aa2f5f9f8187ebd7cdda0c4a597d1203f7ef980595f6ec72d490b3d24e55da17600b201f947bc5fd3fd5f0741
-
SSDEEP
3072:xwcPM9Vv08oewxwcP78/k9T028qqcVz5fzsTl4dsOc6v2vTzwU+Pho86meq+FaSj:HPiZ08WHPEcT93PiY+Fa7BdvG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp259398166.exe -
Executes dropped EXE 2 IoCs
pid Process 2364 tmp259398166.exe 2112 tmp259398197.exe -
Loads dropped DLL 3 IoCs
pid Process 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe -
resource yara_rule behavioral1/memory/1520-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0002000000011c9f-24.dat upx behavioral1/memory/1520-26-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.tmp tmp259398166.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp259398166.exe File created C:\Windows\SysWOW64\fsb.stb tmp259398166.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe- tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe- tmp259398166.exe File created C:\Program Files\Java\jre7\bin\ktab.exe tmp259398166.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- tmp259398166.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe- tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe- tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe- tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe- tmp259398166.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe tmp259398166.exe File created C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE- tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe tmp259398166.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe- tmp259398166.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe tmp259398166.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe tmp259398166.exe File created C:\Program Files\7-Zip\Uninstall.exe- tmp259398166.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe- tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE- tmp259398166.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- tmp259398166.exe File created C:\Program Files\Java\jre7\bin\servertool.exe- tmp259398166.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe tmp259398166.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe- tmp259398166.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE- tmp259398166.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe tmp259398166.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE tmp259398166.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe- tmp259398166.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe- tmp259398166.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe- tmp259398166.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe tmp259398166.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe- tmp259398166.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe tmp259398166.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe- tmp259398166.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe tmp259398166.exe File created C:\Program Files\Java\jre7\bin\kinit.exe- tmp259398166.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe- tmp259398166.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe- tmp259398166.exe File created C:\Program Files\Java\jre7\bin\java-rmi.exe- tmp259398166.exe File created C:\Program Files\Java\jre7\bin\javacpl.exe- tmp259398166.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe tmp259398166.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe tmp259398166.exe File created C:\Program Files\Java\jre7\bin\java.exe- tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE- tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE tmp259398166.exe File created C:\Program Files\7-Zip\Uninstall.exe tmp259398166.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe tmp259398166.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe- tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE tmp259398166.exe File created C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE- tmp259398166.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe tmp259398166.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe tmp259398166.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe tmp259398166.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2364 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 28 PID 1520 wrote to memory of 2364 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 28 PID 1520 wrote to memory of 2364 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 28 PID 1520 wrote to memory of 2364 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 28 PID 1520 wrote to memory of 2112 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 29 PID 1520 wrote to memory of 2112 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 29 PID 1520 wrote to memory of 2112 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 29 PID 1520 wrote to memory of 2112 1520 d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe"C:\Users\Admin\AppData\Local\Temp\d9e824ace2947698fb586c7348f660c986e642a05f7fbef46e9f5a8f6d663ef4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\tmp259398166.exeC:\Users\Admin\AppData\Local\Temp\tmp259398166.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2364
-
-
C:\Users\Admin\AppData\Local\Temp\tmp259398197.exeC:\Users\Admin\AppData\Local\Temp\tmp259398197.exe2⤵
- Executes dropped EXE
PID:2112
-
Network
-
Remote address:8.8.8.8:53Requestuk.undernet.orgIN AResponse
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
-
-
-
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 120 B 3 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606KB
MD5e437fcaf41acd150f913f72135acb53e
SHA17526b5daa35bebc04500c8d1431725ba3e7b7812
SHA256b978bd0dbd2a26f00fbb44b7ca2834dee7129b302bbb894ead494e247326f1a8
SHA51295874f0a78e839d69670625e314697fbdb64f0a4d6593647df728b4b96ed285f30d3f57978fac12f2c33097d1ede6fcc8b3bc4ce05a979128100606f104a02f5
-
Filesize
51KB
MD565e8d7fc3273b68dbfe23fdc81a953c2
SHA19d55f0c92a6cd7821e61aac5faede6a642fa30a1
SHA25642767915cfbc0a25e6e14361f52a8c3816fa54e47480453ec72af4cd79f99329
SHA51203b6327f4786331d4d31936741b8fb83496dc53e10018863ddb6f6cd66599137f9b6f2c89237d13151f7546d31cf652732d0781ba2ca090ce7dcd5a991b8baeb
-
Filesize
213KB
MD520d89d1781cde87db3a8b59da816efcc
SHA14f6670c4dcd8d978b21d1db91e081e609f5abcd0
SHA2564653df6eb852f717ac03d5ecdfdd5e1e2c1ac70b012049f1188e0e7d5b5f8983
SHA5127b03a2e2c5f94a3e6164e160e3346cf0e8247471c48858dad9747dc17c8bccd20caaf2ea9f15d7e6be3e633a01536caefdeff6b384c4448c861f1e5a5ff6cf0e