c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Size 470KB
Sample240614-ehhzlsyarr
SHA256 c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0
MD5 c26d65d2ab20e394f08bb28e20c392c7
SHA1 dfafd00fccab67aefb6ca0224e0404e36ddf5c90
SHA512 4eb5fcfb6e7d8a4cc8270a780d8ab5efa87944d40d401ab49d42c595e9ad435f9de9851095ee78bc49e17ad837041c239b0676132a25dc987fa03d2a4809dd2b
SSDEEP 12288:ijpD/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8QVj7:ijh4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe

Executes dropped EXE 1 IoCs

pid	Process
2676	Nkcmohbg.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
624	2676	WerFault.exe	81

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2676	3764	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe	81
PID 3764 wrote to memory of 2676	3764	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe	81
PID 3764 wrote to memory of 2676	3764	c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe	81

C:\Users\Admin\AppData\Local\Temp\c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe
"C:\Users\Admin\AppData\Local\Temp\c88ce28c11b0f0b203b2857563b844ea8f408b374633b2d26f41de713d03b9b0.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\Nkcmohbg.exe
  C:\Windows\system32\Nkcmohbg.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 412
    3⤵
    - Program crash
    PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2676 -ip 2676
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 470KB
SHA256 a0f2812c35062f9b7f4e7f37555160abaaeadb721f80b38ffb621f3752e6a49d
MD5 1dda8dfa8d1a7e7d111008869fbbdf48
SHA1 b604b7499f8b455d8d87fd66da4447ba70e028dd
SHA512 8e0a75229936c90560adbd76b6247fb2efb0bdae91da4cf35228d0ded320a261c192cfa3a6b95e2f3a4758edc6a186881c542b29e3fd5e996aeb44df744565ae
SSDEEP 12288:oi/Qc8QVj94nLiFzN3b7CUq1u2ztB1XQKTQInqyS6Rm6TIJ3l7DurTG9c8QVj948:h4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2676-8-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/2676-11-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/3764-0-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/3764-12-0x0000000000400000-0x000000000049E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads