797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
Size

5.1MB
MD5

12ebeff0cbc67b2669736813eacff30f
SHA1

5d5c9cfb2de811e5f98104e4e404fe4f3661c620
SHA256

797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436
SHA512

d7bd27fbb15497500b5c83e9f952c51a866eaaf0314dc566ae85d835aba9978c9109ecb0c96a072f90408af0af0bd41ba6411d793edf2403117a7e7c37dd1b8f
SSDEEP

98304:vgRS4EdPC5gYJU5ue4HV8n1qt5WjphbsC2o4wa+eO9OJsvJ2l6VY:vcEZCX6BCu1qtChbJa+eOUJq2Aa

Score

9^/10

persistence

Malware Config

Signatures

Detects .NET executables utilizing NyanX-CAT C# Loader 4 IoCs

resource	yara_rule
behavioral1/memory/2372-4-0x0000000000390000-0x0000000000FDA000-memory.dmp	INDICATOR_EXE_Packed_NyanXCat_CSharpLoader
behavioral1/memory/2372-6-0x0000000000390000-0x0000000000FDA000-memory.dmp	INDICATOR_EXE_Packed_NyanXCat_CSharpLoader
behavioral1/memory/2372-8-0x0000000000390000-0x0000000000FDA000-memory.dmp	INDICATOR_EXE_Packed_NyanXCat_CSharpLoader
behavioral1/memory/2372-32-0x0000000000390000-0x0000000000FDA000-memory.dmp	INDICATOR_EXE_Packed_NyanXCat_CSharpLoader

Detects executables packed with unregistered version of .NET Reactor 5 IoCs

resource	yara_rule
behavioral1/memory/1604-56-0x0000000000400000-0x0000000000E02000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1604-55-0x0000000000400000-0x0000000000E02000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1604-57-0x0000000000400000-0x0000000000E02000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1604-58-0x0000000000400000-0x0000000000E02000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1604-59-0x0000000000400000-0x0000000000E02000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

.NET Reactor proctector 5 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/1604-56-0x0000000000400000-0x0000000000E02000-memory.dmp	net_reactor
behavioral1/memory/1604-55-0x0000000000400000-0x0000000000E02000-memory.dmp	net_reactor
behavioral1/memory/1604-57-0x0000000000400000-0x0000000000E02000-memory.dmp	net_reactor
behavioral1/memory/1604-58-0x0000000000400000-0x0000000000E02000-memory.dmp	net_reactor
behavioral1/memory/1604-59-0x0000000000400000-0x0000000000E02000-memory.dmp	net_reactor

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fantastic.lnk	RegAsm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fantastic.lnk	RegAsm.exe

Loads dropped DLL 1 IoCs

pid	Process
1604	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\chome_exe = "C:\\Windows\\Fonts\\HWMonitor\\HWMonitor.exe"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 38 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
21	pastebin.com
32	pastebin.com
4	pastebin.com
7	pastebin.com
10	pastebin.com
37	pastebin.com
30	pastebin.com
31	pastebin.com
36	pastebin.com
6	pastebin.com
26	pastebin.com
34	pastebin.com
9	pastebin.com
29	pastebin.com
35	pastebin.com
24	pastebin.com
33	pastebin.com
39	pastebin.com
41	pastebin.com
15	pastebin.com
17	pastebin.com
22	pastebin.com
18	pastebin.com
25	pastebin.com
27	pastebin.com
28	pastebin.com
5	pastebin.com
8	pastebin.com
13	pastebin.com
40	pastebin.com
12	pastebin.com
16	pastebin.com
23	pastebin.com
38	pastebin.com
11	pastebin.com
19	pastebin.com
20	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe
1604	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\HWMonitor\HWMonitor.exe	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	1604	RegAsm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
1604	RegAsm.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2672	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	28
PID 2372 wrote to memory of 2672	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	28
PID 2372 wrote to memory of 2672	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	28
PID 2372 wrote to memory of 2672	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	28
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 2548	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	30
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31
PID 2372 wrote to memory of 1604	2372	797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe	31

C:\Users\Admin\AppData\Local\Temp\797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe
"C:\Users\Admin\AppData\Local\Temp\797b687d1c6a86b8401cd0ab5b4face90cf47d7bc07ee35ec393291afd213436.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'chome_exe' -Value '"C:\Windows\Fonts\HWMonitor\HWMonitor.exe"' -PropertyType 'String'
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\fantastic.exe

Filesize
63KB

MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/1604-34-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-20-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-59-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-58-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-57-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-54-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-55-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-42-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-44-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-39-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-53-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-15-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-23-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-21-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-17-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1604-25-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-29-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-28-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-30-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-56-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-46-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-47-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-36-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-48-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-35-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-37-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-43-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-45-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-38-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-49-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-51-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-52-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/1604-50-0x0000000000400000-0x0000000000E02000-memory.dmp

Filesize
10.0MB

Download
memory/2372-6-0x0000000000390000-0x0000000000FDA000-memory.dmp

Filesize
12.3MB

Download
memory/2372-2-0x0000000077670000-0x0000000077671000-memory.dmp

Filesize
4KB

Download
memory/2372-33-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-32-0x0000000000390000-0x0000000000FDA000-memory.dmp

Filesize
12.3MB

Download
memory/2372-0-0x0000000000390000-0x0000000000FDA000-memory.dmp

Filesize
12.3MB

Download
memory/2372-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2372-7-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2372-8-0x0000000000390000-0x0000000000FDA000-memory.dmp

Filesize
12.3MB

Download
memory/2372-3-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/2372-9-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-5-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-4-0x0000000000390000-0x0000000000FDA000-memory.dmp

Filesize
12.3MB

Download
memory/2372-10-0x000000000A8E0000-0x000000000AB60000-memory.dmp

Filesize
2.5MB

Download
memory/2672-14-0x00000000003D0000-0x0000000000410000-memory.dmp

Filesize
256KB

Download