Resubmissions
18-06-2024 06:55
240618-hpyv7a1hqh 10Analysis
-
max time kernel
46s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-06-2024 06:55
Behavioral task
behavioral1
Sample
sysEXEC/deter.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
sysEXEC/deter.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
sysEXEC/quickDrop.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral4
Sample
sysEXEC/quickDrop.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
sysEXEC/sysEXEC.exe
Resource
win7-20240508-en
windows7-x64
General
-
Target
sysEXEC/sysEXEC.exe
-
Size
14.5MB
-
MD5
02d12d780b93209fad2a6dc29716b278
-
SHA1
d425f1c11190044e07be7c87845a0a89203fec9e
-
SHA256
1302f2c7054ea7194ce07428af0c2fa00c46e2d27fb96e7734f09cdab139b1a5
-
SHA512
6f9c5a62742049f0218ddcf59ef880f231809010cbad3954197616036828839893b2af38137c419732f2a3dda8f41b32a8ad4845b48c1bb506f52ad0448241b1
-
SSDEEP
393216:LEkZQ0dQuslSq99oWOv+9fgWtRT7k3he:LhQ0dQuSDorvSYWtl74h
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2512 sysEXEC.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1652 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe 1652 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 956 wrote to memory of 2512 956 sysEXEC.exe 29 PID 956 wrote to memory of 2512 956 sysEXEC.exe 29 PID 956 wrote to memory of 2512 956 sysEXEC.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\sysEXEC\sysEXEC.exe"C:\Users\Admin\AppData\Local\Temp\sysEXEC\sysEXEC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\sysEXEC\sysEXEC.exe"C:\Users\Admin\AppData\Local\Temp\sysEXEC\sysEXEC.exe"2⤵
- Loads dropped DLL
PID:2512
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1652
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989