Analysis
-
max time kernel
89s -
max time network
97s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-06-2024 07:49
Behavioral task
behavioral1
Sample
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe
Resource
win11-20240611-en
General
-
Target
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe
-
Size
48KB
-
MD5
483fe860119307c2f9e2f7ed4caadc81
-
SHA1
b5fa21f06419e585cb9faa7227f1931a8521ca5f
-
SHA256
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23
-
SHA512
4590310719d9a253e71dcb46775029d1213c87f21d6d002ec78584cc5eece9fdf169af174ae287a9328c81c1699927b552fdb1b4b8d1b59f706511ae48b142c7
-
SSDEEP
768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67dhPC:Ub1MsHz3JDwhyWr+N95OTga6u
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remoctds\Parameters\ServiceDll = "C:\\Program Files (x86)\\Google\\240612000.dll" acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe -
Loads dropped DLL 1 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exepid process 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe -
Creates a Windows Service
-
Drops file in Program Files directory 1 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exedescription ioc process File created C:\Program Files (x86)\Google\240612000.dll acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exepid process 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exedescription pid process Token: SeIncBasePriorityPrivilege 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exepid process 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.execmd.exedescription pid process target process PID 3732 wrote to memory of 4356 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe cmd.exe PID 3732 wrote to memory of 4356 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe cmd.exe PID 3732 wrote to memory of 4356 3732 acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe cmd.exe PID 4356 wrote to memory of 4964 4356 cmd.exe PING.EXE PID 4356 wrote to memory of 4964 4356 cmd.exe PING.EXE PID 4356 wrote to memory of 4964 4356 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe"C:\Users\Admin\AppData\Local\Temp\acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- Runs ping.exe
PID:4964
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remoctds"1⤵PID:3212
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remoctds"1⤵PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD529735051033ee32bad62253a15518418
SHA1631fbe5f2b84535625b6673de4103fa1134f32b2
SHA2562b84c060fe74510892e1f42f3fb759468cfe4b847b4ca3d6f01d292661ca8297
SHA512aa0f8f32ef13568cbb6f3fb80626a30cec2d88fae32c3a36b9f4ead3739cb51c3772dc8dbfde00a6e094c7b9a5ef5ac9b82790edffd842f60f52c3fb3e020d39