Analysis
-
max time kernel
146s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-07-2024 04:17
Static task
static1
Behavioral task
behavioral1
Sample
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
Resource
win11-20240709-en
General
-
Target
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
-
Size
2.2MB
-
MD5
ffe6422dff4cbe7efdbd7ac4983504d4
-
SHA1
b67e47c4469476baa69803a3183f2c5a821ad5b1
-
SHA256
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26
-
SHA512
626e085ef91b16ba1d2c7211de287854b4a7e85282ccc5a863aa3603f5249ad6dcd2ae2127142268341a5cc28d91ba4f6b9bab3bef268f35e3e683ee929bf499
-
SSDEEP
49152:z79Bu1YpCIlTKgirv6NruEf9MpehiCcOIo8R+jl3W:zpBu2flTXmpehGOV8cjRW
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rfsjcv.exerfsjcv.exepid process 2168 rfsjcv.exe 4800 rfsjcv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hypdhoszwhs = "C:\\Users\\Admin\\AppData\\Roaming\\Hypdhoszwhs.exe" db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exerfsjcv.exedescription pid process target process PID 4616 set thread context of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2168 set thread context of 4800 2168 rfsjcv.exe rfsjcv.exe -
Drops file in Windows directory 1 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exedescription ioc process File created C:\Windows\Tasks\Test Task17.job db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exerfsjcv.exedescription pid process Token: SeDebugPrivilege 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe Token: SeDebugPrivilege 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe Token: SeDebugPrivilege 2168 rfsjcv.exe Token: SeDebugPrivilege 2168 rfsjcv.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exerfsjcv.exedescription pid process target process PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 4616 wrote to memory of 728 4616 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe PID 2168 wrote to memory of 4800 2168 rfsjcv.exe rfsjcv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"2⤵
- Drops file in Windows directory
PID:728
-
C:\ProgramData\lgcd\rfsjcv.exeC:\ProgramData\lgcd\rfsjcv.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\ProgramData\lgcd\rfsjcv.exe"C:\ProgramData\lgcd\rfsjcv.exe"2⤵
- Executes dropped EXE
PID:4800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ffe6422dff4cbe7efdbd7ac4983504d4
SHA1b67e47c4469476baa69803a3183f2c5a821ad5b1
SHA256db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26
SHA512626e085ef91b16ba1d2c7211de287854b4a7e85282ccc5a863aa3603f5249ad6dcd2ae2127142268341a5cc28d91ba4f6b9bab3bef268f35e3e683ee929bf499
-
Filesize
234B
MD55e1f2b776a5dab2a30d432fa86d8cd58
SHA1fd40dca1b5d8fd557079554de397f06d388bcb93
SHA2561f866481f864abe3de67aea8d2eebaac724ed85cacbf791032a46eaec2b71871
SHA5124d33afa188978c9c97c6e538f9f7f681369ddea1056a80e3016a8fdc32b04db5bade7ed8b2839a74c00ea92292f77b9711c07efe308ef556ffe419b2b4b64ead