Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 04:43
Static task
static1
Behavioral task
behavioral1
Sample
83bd4c82f7196a7face917002254a380N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
83bd4c82f7196a7face917002254a380N.exe
Resource
win10v2004-20240709-en
General
-
Target
83bd4c82f7196a7face917002254a380N.exe
-
Size
464KB
-
MD5
83bd4c82f7196a7face917002254a380
-
SHA1
f209e7c66df4d5d633ea9680747f8e9633760ac4
-
SHA256
f1711fbc603919114f65736e3579f9a05ee0c1edede8e92cdac3fa5bb82d379a
-
SHA512
437eaf5c9568cec9cf5c868b7b8ff145684d654a1f1ca4f8da4956a3125cc4370c78b757f098ac29c15f0e99862bfa00e1b406eba8afaaf1dcc16a63460d790b
-
SSDEEP
6144:CHkWcDpi78KSrafqV5areuyFwBqgmGNGXN/O8OCLV0wbmztvchDVmKQQWLpYzLtF:CHlc87eqqV5e+wBV6O+tYtEVmKnWNY
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2604 MigAdown.exe 1436 cleaclip.exe 2392 ~E82D.tmp -
Loads dropped DLL 3 IoCs
pid Process 1432 83bd4c82f7196a7face917002254a380N.exe 1432 83bd4c82f7196a7face917002254a380N.exe 2604 MigAdown.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmdhone = "C:\\Users\\Admin\\AppData\\Roaming\\dxdistsc\\MigAdown.exe" 83bd4c82f7196a7face917002254a380N.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\cleaclip.exe 83bd4c82f7196a7face917002254a380N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2604 MigAdown.exe 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2604 MigAdown.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2604 1432 83bd4c82f7196a7face917002254a380N.exe 30 PID 1432 wrote to memory of 2604 1432 83bd4c82f7196a7face917002254a380N.exe 30 PID 1432 wrote to memory of 2604 1432 83bd4c82f7196a7face917002254a380N.exe 30 PID 1432 wrote to memory of 2604 1432 83bd4c82f7196a7face917002254a380N.exe 30 PID 2604 wrote to memory of 2392 2604 MigAdown.exe 32 PID 2604 wrote to memory of 2392 2604 MigAdown.exe 32 PID 2604 wrote to memory of 2392 2604 MigAdown.exe 32 PID 2604 wrote to memory of 2392 2604 MigAdown.exe 32 PID 2392 wrote to memory of 1380 2392 ~E82D.tmp 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\83bd4c82f7196a7face917002254a380N.exe"C:\Users\Admin\AppData\Local\Temp\83bd4c82f7196a7face917002254a380N.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Roaming\dxdistsc\MigAdown.exe"C:\Users\Admin\AppData\Roaming\dxdistsc"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\~E82D.tmp1380 475656 2604 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392
-
-
-
-
C:\Windows\SysWOW64\cleaclip.exeC:\Windows\SysWOW64\cleaclip.exe -s1⤵
- Executes dropped EXE
PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
464KB
MD50915557170875b7f0a55f0df2f503480
SHA17768c11f6454457f61693ed4de01820fa55daa8f
SHA25622408aad16738c15d652576c8ed78dec5e761d87ee643d31eab00bf3e361f185
SHA512b735bbddee85adfd65b414b78599f9fa7f5f5ce85cd5c1189461b783000c2fce265a10a8491062dcfa25566eb53ad14822136226d8ae1ed2e35fd2d7fe658b21