Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 12:27
Behavioral task
behavioral1
Sample
dcf2ceb7faa5754e5fb0b7db1cc23637.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dcf2ceb7faa5754e5fb0b7db1cc23637.exe
Resource
win10v2004-20240709-en
General
-
Target
dcf2ceb7faa5754e5fb0b7db1cc23637.exe
-
Size
33KB
-
MD5
dcf2ceb7faa5754e5fb0b7db1cc23637
-
SHA1
0259609ed1ec649f797869ca14a7aef9f2029ffb
-
SHA256
9732f930cd31110f63aaf92cc17895b65303bb06a4968b127f4687270941acdd
-
SHA512
2f2347bf1fffe021deaae8a77695026498d8d9c8e715ed991cdaa4086c4df9196d4592855947912c27b7bb56f1567f92fe1cfaf324d2d41291618009b26fb487
-
SSDEEP
384:dHjYE/8qnRY1yoY4CTj0MiKSFp9paTqjkSdKrA+5WmC9NAkYIbdkK8oy10jq4ryj:ZEi7/iKSBpaPL0XY0jSSfOf876sNfpE
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/3008-1-0x0000000000C50000-0x0000000000C5E000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dcf2ceb7faa5754e5fb0b7db1cc23637 = "C:\\Users\\Admin\\Documents\\dcf2ceb7faa5754e5fb0b7db1cc23637.pif" reg.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
dcf2ceb7faa5754e5fb0b7db1cc23637.exeRegAsm.exefindstr.exedescription pid process target process PID 3008 set thread context of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 4912 set thread context of 3444 4912 RegAsm.exe Explorer.EXE PID 4912 set thread context of 912 4912 RegAsm.exe findstr.exe PID 912 set thread context of 3444 912 findstr.exe Explorer.EXE PID 912 set thread context of 3908 912 findstr.exe Firefox.exe -
Processes:
findstr.exedescription ioc process Key created \Registry\User\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 findstr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dcf2ceb7faa5754e5fb0b7db1cc23637.exeRegAsm.exefindstr.exepid process 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 4912 RegAsm.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegAsm.exeExplorer.EXEfindstr.exepid process 4912 RegAsm.exe 3444 Explorer.EXE 3444 Explorer.EXE 912 findstr.exe 912 findstr.exe 912 findstr.exe 912 findstr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dcf2ceb7faa5754e5fb0b7db1cc23637.exedescription pid process Token: SeDebugPrivilege 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3444 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
dcf2ceb7faa5754e5fb0b7db1cc23637.execmd.exeExplorer.EXEfindstr.exedescription pid process target process PID 3008 wrote to memory of 2856 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe cmd.exe PID 3008 wrote to memory of 2856 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe cmd.exe PID 3008 wrote to memory of 2856 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe cmd.exe PID 2856 wrote to memory of 3536 2856 cmd.exe reg.exe PID 2856 wrote to memory of 3536 2856 cmd.exe reg.exe PID 2856 wrote to memory of 3536 2856 cmd.exe reg.exe PID 3008 wrote to memory of 4312 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe cmd.exe PID 3008 wrote to memory of 4312 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe cmd.exe PID 3008 wrote to memory of 4312 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe cmd.exe PID 3008 wrote to memory of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 3008 wrote to memory of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 3008 wrote to memory of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 3008 wrote to memory of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 3008 wrote to memory of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 3008 wrote to memory of 4912 3008 dcf2ceb7faa5754e5fb0b7db1cc23637.exe RegAsm.exe PID 3444 wrote to memory of 912 3444 Explorer.EXE findstr.exe PID 3444 wrote to memory of 912 3444 Explorer.EXE findstr.exe PID 3444 wrote to memory of 912 3444 Explorer.EXE findstr.exe PID 912 wrote to memory of 3908 912 findstr.exe Firefox.exe PID 912 wrote to memory of 3908 912 findstr.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\dcf2ceb7faa5754e5fb0b7db1cc23637.exe"C:\Users\Admin\AppData\Local\Temp\dcf2ceb7faa5754e5fb0b7db1cc23637.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dcf2ceb7faa5754e5fb0b7db1cc23637" /t REG_SZ /F /D "C:\Users\Admin\Documents\dcf2ceb7faa5754e5fb0b7db1cc23637.pif"3⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dcf2ceb7faa5754e5fb0b7db1cc23637" /t REG_SZ /F /D "C:\Users\Admin\Documents\dcf2ceb7faa5754e5fb0b7db1cc23637.pif"4⤵
- Adds Run key to start application
PID:3536 -
C:\Windows\SysWOW64\cmd.execmd /c Copy "C:\Users\Admin\AppData\Local\Temp\dcf2ceb7faa5754e5fb0b7db1cc23637.exe" "C:\Users\Admin\Documents\dcf2ceb7faa5754e5fb0b7db1cc23637.pif"3⤵PID:4312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4912 -
C:\Windows\SysWOW64\findstr.exe"C:\Windows\SysWOW64\findstr.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3908