ea5c40953d12e558456f1423e3bca11928623a562ed2efb5fd47ab3acf90e880

Analysis

max time kernel
139s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe
Size 4.3MB
Sample240617-bd5e9swhrf
SHA256 cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e
MD5 8d253537af839ffffa35002272a69975
SHA1 75def7b867b5d7930416337d32fa7735cd62c9d1
SHA512 6e6a29739e4a1d2153787cc726e1aea51e37f51ea4b31fbde97cb55105dbc67413aa4e2b079df67332823615f76ffc1b06de0e6a4a09a4b881a89d79c0ce84ca
SSDEEP 24576:tTCsLxyCB/T0DwDCuk1H4ki+kwQpQPm0TVBTBMqpPYx0d41QixgN463thBedtE:tusLx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
980	rqhfqb.exe
3356	rqhfqb.exe
3532	rqhfqb.exe
2868	rqhfqb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Immmsbclaz = "C:\\Users\\Admin\\AppData\\Roaming\\Immmsbclaz.exe"	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 980 set thread context of 3356	980	rqhfqb.exe	33
PID 3532 set thread context of 2868	3532	rqhfqb.exe	35

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Test Task17.job	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe
Token: SeDebugPrivilege	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe
Token: SeDebugPrivilege	980	rqhfqb.exe
Token: SeDebugPrivilege	980	rqhfqb.exe
Token: SeDebugPrivilege	3532	rqhfqb.exe
Token: SeDebugPrivilege	3532	rqhfqb.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 1720 wrote to memory of 2352	1720	cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe	30
PID 3052 wrote to memory of 980	3052	taskeng.exe	32
PID 3052 wrote to memory of 980	3052	taskeng.exe	32
PID 3052 wrote to memory of 980	3052	taskeng.exe	32
PID 3052 wrote to memory of 980	3052	taskeng.exe	32
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 980 wrote to memory of 3356	980	rqhfqb.exe	33
PID 3052 wrote to memory of 3532	3052	taskeng.exe	34
PID 3052 wrote to memory of 3532	3052	taskeng.exe	34
PID 3052 wrote to memory of 3532	3052	taskeng.exe	34
PID 3052 wrote to memory of 3532	3052	taskeng.exe	34
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35
PID 3532 wrote to memory of 2868	3532	rqhfqb.exe	35

C:\Users\Admin\AppData\Local\Temp\cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe
"C:\Users\Admin\AppData\Local\Temp\cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe
  "C:\Users\Admin\AppData\Local\Temp\cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e.exe"
  2⤵
  - Drops file in Windows directory
  PID:2352

C:\Windows\system32\taskeng.exe
taskeng.exe {8EE3BF86-EFD1-4EEC-887F-672D14D4C539} S-1-5-21-39690363-730359138-1046745555-1000:EILATWEW\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\ProgramData\gukqklu\rqhfqb.exe
  C:\ProgramData\gukqklu\rqhfqb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\ProgramData\gukqklu\rqhfqb.exe
    "C:\ProgramData\gukqklu\rqhfqb.exe"
    3⤵
    - Executes dropped EXE
    PID:3356
- C:\ProgramData\gukqklu\rqhfqb.exe
  C:\ProgramData\gukqklu\rqhfqb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\ProgramData\gukqklu\rqhfqb.exe
    "C:\ProgramData\gukqklu\rqhfqb.exe"
    3⤵
    - Executes dropped EXE
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rqhfqb.exe

Path C:\ProgramData\gukqklu\rqhfqb.exe
Size 4.3MB
SHA256 cf9aee9be42a9a9b88268906e8751200b84e727e39953ab0e1da4ec590db695e
MD5 8d253537af839ffffa35002272a69975
SHA1 75def7b867b5d7930416337d32fa7735cd62c9d1
SHA512 6e6a29739e4a1d2153787cc726e1aea51e37f51ea4b31fbde97cb55105dbc67413aa4e2b079df67332823615f76ffc1b06de0e6a4a09a4b881a89d79c0ce84ca
SSDEEP 24576:tTCsLxyCB/T0DwDCuk1H4ki+kwQpQPm0TVBTBMqpPYx0d41QixgN463thBedtE:tusLx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Test Task17.job

Path C:\Windows\Tasks\Test Task17.job
Size 222B
SHA256 bf4048546f9253f7279c34de727c970fd878a9579150ffad4510c7b5111a1f72
MD5 a7de3f7c3a989adf7ace956b1856c4a0
SHA1 08f83300bcdeb135844288b285e2309ce63ebd1a
SHA512 600c4a3fa009a2f0ee540430b0d14b7d5ff58ba0ed2062ab70d9d22c602398ce28d81f68c9683210a2fc59059267477f5cca586c40c7941a19d7ccc6eaaa9bab
MD5 SHA1 SHA512

Submit Download

memory/980-4913-0x000000007449E000-0x000000007449F000-memory.dmp

Download

memory/980-4914-0x0000000001240000-0x000000000169E000-memory.dmp

Download

memory/980-9801-0x0000000074490000-0x0000000074B7E000-memory.dmp

Download

memory/980-9820-0x0000000074490000-0x0000000074B7E000-memory.dmp

Download

memory/980-9805-0x0000000004DF0000-0x0000000004E44000-memory.dmp

Download

memory/980-9804-0x0000000074490000-0x0000000074B7E000-memory.dmp

Download

memory/980-9803-0x000000007449E000-0x000000007449F000-memory.dmp

Download

memory/980-9802-0x0000000074490000-0x0000000074B7E000-memory.dmp

Download

memory/1720-44-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-54-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-32-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-31-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-36-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-22-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-38-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-20-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-18-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-40-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-16-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-14-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-12-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-10-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-42-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-8-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-26-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-24-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-28-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-46-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-48-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-50-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-52-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-34-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-56-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-58-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-60-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-62-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-64-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-66-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-4890-0x0000000004DF0000-0x0000000004E3C000-memory.dmp

Download

memory/1720-4889-0x00000000009E0000-0x0000000000A3A000-memory.dmp

Download

memory/1720-4891-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Download

memory/1720-4892-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Download

memory/1720-3-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-6-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-4-0x0000000005FB0000-0x00000000061C7000-memory.dmp

Download

memory/1720-2-0x0000000005FB0000-0x00000000061CE000-memory.dmp

Download

memory/1720-1-0x0000000000A50000-0x0000000000EAE000-memory.dmp

Download

memory/1720-4893-0x00000000744EE000-0x00000000744EF000-memory.dmp

Download

memory/1720-4894-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Download

memory/1720-4895-0x0000000004610000-0x0000000004664000-memory.dmp

Download

memory/1720-4910-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Download

memory/1720-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

Download

memory/2352-4907-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3532-9823-0x0000000001240000-0x000000000169E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads