Analysis
-
max time kernel
295s -
max time network
306s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 05:14
Static task
static1
Behavioral task
behavioral1
Sample
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
Resource
win10-20240404-en
General
-
Target
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
-
Size
2.2MB
-
MD5
ffe6422dff4cbe7efdbd7ac4983504d4
-
SHA1
b67e47c4469476baa69803a3183f2c5a821ad5b1
-
SHA256
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26
-
SHA512
626e085ef91b16ba1d2c7211de287854b4a7e85282ccc5a863aa3603f5249ad6dcd2ae2127142268341a5cc28d91ba4f6b9bab3bef268f35e3e683ee929bf499
-
SSDEEP
49152:z79Bu1YpCIlTKgirv6NruEf9MpehiCcOIo8R+jl3W:zpBu2flTXmpehGOV8cjRW
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
Processes:
urhkr.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exepid process 808 urhkr.exe 2224 urhkr.exe 2848 urhkr.exe 1856 urhkr.exe 1680 urhkr.exe 3268 urhkr.exe 3440 urhkr.exe 2520 urhkr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hypdhoszwhs = "C:\\Users\\Admin\\AppData\\Roaming\\Hypdhoszwhs.exe" db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exedescription pid process target process PID 2348 set thread context of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 808 set thread context of 2224 808 urhkr.exe urhkr.exe PID 2848 set thread context of 1856 2848 urhkr.exe urhkr.exe PID 1680 set thread context of 3268 1680 urhkr.exe urhkr.exe PID 3440 set thread context of 2520 3440 urhkr.exe urhkr.exe -
Drops file in Windows directory 1 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exedescription ioc process File created C:\Windows\Tasks\Test Task17.job db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exedescription pid process Token: SeDebugPrivilege 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe Token: SeDebugPrivilege 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe Token: SeDebugPrivilege 808 urhkr.exe Token: SeDebugPrivilege 808 urhkr.exe Token: SeDebugPrivilege 2848 urhkr.exe Token: SeDebugPrivilege 2848 urhkr.exe Token: SeDebugPrivilege 1680 urhkr.exe Token: SeDebugPrivilege 1680 urhkr.exe Token: SeDebugPrivilege 3440 urhkr.exe Token: SeDebugPrivilege 3440 urhkr.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exetaskeng.exeurhkr.exeurhkr.exeurhkr.exeurhkr.exedescription pid process target process PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 2348 wrote to memory of 1788 2348 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 912 wrote to memory of 808 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 808 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 808 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 808 912 taskeng.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 808 wrote to memory of 2224 808 urhkr.exe urhkr.exe PID 912 wrote to memory of 2848 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 2848 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 2848 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 2848 912 taskeng.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 2848 wrote to memory of 1856 2848 urhkr.exe urhkr.exe PID 912 wrote to memory of 1680 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 1680 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 1680 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 1680 912 taskeng.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 1680 wrote to memory of 3268 1680 urhkr.exe urhkr.exe PID 912 wrote to memory of 3440 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 3440 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 3440 912 taskeng.exe urhkr.exe PID 912 wrote to memory of 3440 912 taskeng.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe PID 3440 wrote to memory of 2520 3440 urhkr.exe urhkr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"2⤵
- Drops file in Windows directory
PID:1788
-
C:\Windows\system32\taskeng.exetaskeng.exe {2567EF8D-0EBB-45EE-9500-7B7BC0684EA8} S-1-5-21-2958949473-3205530200-1453100116-1000:WHMFPZKA\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\ProgramData\bireu\urhkr.exeC:\ProgramData\bireu\urhkr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808 -
C:\ProgramData\bireu\urhkr.exe"C:\ProgramData\bireu\urhkr.exe"3⤵
- Executes dropped EXE
PID:2224 -
C:\ProgramData\bireu\urhkr.exeC:\ProgramData\bireu\urhkr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\ProgramData\bireu\urhkr.exe"C:\ProgramData\bireu\urhkr.exe"3⤵
- Executes dropped EXE
PID:1856 -
C:\ProgramData\bireu\urhkr.exeC:\ProgramData\bireu\urhkr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\ProgramData\bireu\urhkr.exe"C:\ProgramData\bireu\urhkr.exe"3⤵
- Executes dropped EXE
PID:3268 -
C:\ProgramData\bireu\urhkr.exeC:\ProgramData\bireu\urhkr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\ProgramData\bireu\urhkr.exe"C:\ProgramData\bireu\urhkr.exe"3⤵
- Executes dropped EXE
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ffe6422dff4cbe7efdbd7ac4983504d4
SHA1b67e47c4469476baa69803a3183f2c5a821ad5b1
SHA256db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26
SHA512626e085ef91b16ba1d2c7211de287854b4a7e85282ccc5a863aa3603f5249ad6dcd2ae2127142268341a5cc28d91ba4f6b9bab3bef268f35e3e683ee929bf499
-
Filesize
216B
MD5da50e0cfc315105abc81bf589c2d6c4b
SHA12a99603ce8e2de4f49804d6b00138ea9a43ffb78
SHA256426962ce0c5924a9a1e1186a2a65f8fa3401ed48e8db7d7c52dc61d41adc3577
SHA512e375067ce52bee1b891132d2a6964570ba78e850c79bb109ab9481f26d9d7e24401df1cab37e733fb503093500352ea4a68aef3b6336c5fac1dd8a6e4e344d14