afc180f84398fdf09969b61c538dd1b7d2259fba43b44a5ed00dac386df7a046

Resubmissions

28-07-2024 09:32

240728-lh334stalh 10

28-07-2024 09:29

240728-lf31bsshnd 10

Analysis

max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windows.exe
Size

913KB
MD5

4c30c907584baa7c1931a3a83ba69149
SHA1

09d3887d9895189a49930a61aea8c788b1ad1c0e
SHA256

afc180f84398fdf09969b61c538dd1b7d2259fba43b44a5ed00dac386df7a046
SHA512

1f581850f9722153d760f6a0f125b71aae3b87546c851a26674cc37ec76b13e39f8abc93a77e1d32fdfe906fa80945fbfb9774cb002dadd922b629879c9246cc
SSDEEP

24576:1Eqr4MROxnF25bYmfFhQ3rZlI0AilFEvxHil71B:1EjMiz3rZlI0AilFEvxHi

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

Processes:

windows.exe

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	windows.exe
File created	C:\Windows\assembly\Desktop.ini	windows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

Processes:

flow	ioc
19	0.tcp.eu.ngrok.io

Drops file in Windows directory 3 IoCs

Processes:

windows.exe

description	ioc	Process
File opened for modification	C:\Windows\assembly	windows.exe
File created	C:\Windows\assembly\Desktop.ini	windows.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	windows.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

windows.exe

description	pid	Process
Token: SeDebugPrivilege	4604	windows.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

windows.execsc.exe

description	pid	Process	procid_target
PID 4604 wrote to memory of 1872	4604	windows.exe	87
PID 4604 wrote to memory of 1872	4604	windows.exe	87
PID 1872 wrote to memory of 2080	1872	csc.exe	89
PID 1872 wrote to memory of 2080	1872	csc.exe	89

C:\Users\Admin\AppData\Local\Temp\windows.exe
"C:\Users\Admin\AppData\Local\Temp\windows.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a0cs2sej.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE4B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE4A.tmp"
    3⤵
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESDE4B.tmp

Filesize
1KB

MD5
a7f81a92f7666f8aeaf5b0f48d668df6

SHA1
502c3be3598f29eb9c0f2cd0a15cfb45f29e356f

SHA256
7279f6fae7a5140e96e4b03a6a7a91dbab415b72f44af26fb8585b867fb622ef

SHA512
a19c5053da1723d8e070e412f47f653d521d9204c5f92a3c88281f38c1f3627643da4f06aec16f5c7c43b09320b1393505b94f1a59aeb019f83047f11e103502

Download Submit
C:\Users\Admin\AppData\Local\Temp\a0cs2sej.dll

Filesize
76KB

MD5
25f9649ac4f783703e45fe5483aa85e7

SHA1
fbede0b641d104767721851bce5ba9a80e1adacb

SHA256
94229d34d99134de7e9552c78d3261236e2b123337be5b02aa4853e15733413a

SHA512
c28a6325742e5eb1af40572a9db1b228077db92df193b1b91f9fbd78f1e49912d63a282143f68803107b5e44485e6c81aae2eea331e8aefd760ecf4f46e25abd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCDE4A.tmp

Filesize
676B

MD5
ff48254b251051d967161e814c0c2b66

SHA1
7374e142fec9e0f8eecbf5ad5a6edc9169872e11

SHA256
1102039163498fafd28b34adf551551a0057cf31841046c2bbd6689cc8a279e5

SHA512
88415880ed8333c09ec356c71886ea6ad5696b9392016f9bc78ec3ee3c7715b9c279d5c020114c586cb1a2d4636931ad34e84b1707ce69833f1d54ad502fe23f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a0cs2sej.0.cs

Filesize
208KB

MD5
64e43cf598e24b19939a6831b8ec9849

SHA1
6efd0b89958568d0b5ee4e449abb078dcb63260b

SHA256
62269db331e568956e4be5f665b6e5c1a414363f177aee486ae61f89c177b904

SHA512
3f1cf646275d93c5f998dc56c13a40194f1314303251ce8fa0e90ffea18f906069724417a658e060d87d7712cfcba85a542ec1ed815effffe6e930ad5f207714

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a0cs2sej.cmdline

Filesize
349B

MD5
5b50a8686dfa977964d8d4e7dab4f8b4

SHA1
69d66a2aa606801cbea01ac14f6201dd19b5a2ea

SHA256
acfdb1e2a3c5f2f791abeb816736d741be3ddff3f4797dc45dbe3affcfc03c8b

SHA512
67daa1bc79f5b239d9f00b1317f5ab51af7a9e96e270bae54f73c6e3278d88574b2bfddf4d7d85985f26ef3b6910e85d89a454d5eaf7bf73c90a77c9469868b2

Download Submit
memory/1872-21-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/1872-14-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-26-0x000000001BDE0000-0x000000001BDE8000-memory.dmp

Filesize
32KB

Download
memory/4604-30-0x000000001E520000-0x000000001E610000-memory.dmp

Filesize
960KB

Download
memory/4604-7-0x000000001C5F0000-0x000000001CABE000-memory.dmp

Filesize
4.8MB

Download
memory/4604-6-0x000000001C000000-0x000000001C00E000-memory.dmp

Filesize
56KB

Download
memory/4604-3-0x000000001BF10000-0x000000001BF6C000-memory.dmp

Filesize
368KB

Download
memory/4604-23-0x000000001D210000-0x000000001D226000-memory.dmp

Filesize
88KB

Download
memory/4604-2-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-1-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-25-0x000000001BE00000-0x000000001BE12000-memory.dmp

Filesize
72KB

Download
memory/4604-0-0x00007FFE70605000-0x00007FFE70606000-memory.dmp

Filesize
4KB

Download
memory/4604-27-0x000000001BF00000-0x000000001BF08000-memory.dmp

Filesize
32KB

Download
memory/4604-28-0x000000001D600000-0x000000001D662000-memory.dmp

Filesize
392KB

Download
memory/4604-29-0x000000001DF60000-0x000000001E51A000-memory.dmp

Filesize
5.7MB

Download
memory/4604-8-0x000000001CB60000-0x000000001CBFC000-memory.dmp

Filesize
624KB

Download
memory/4604-31-0x000000001D260000-0x000000001D27E000-memory.dmp

Filesize
120KB

Download
memory/4604-32-0x000000001E610000-0x000000001E659000-memory.dmp

Filesize
292KB

Download
memory/4604-33-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-34-0x000000001E6D0000-0x000000001E740000-memory.dmp

Filesize
448KB

Download
memory/4604-35-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-37-0x000000001E9B0000-0x000000001E9C8000-memory.dmp

Filesize
96KB

Download
memory/4604-38-0x000000001D780000-0x000000001D790000-memory.dmp

Filesize
64KB

Download
memory/4604-39-0x000000001E740000-0x000000001E748000-memory.dmp

Filesize
32KB

Download
memory/4604-42-0x000000001F4D0000-0x000000001F60C000-memory.dmp

Filesize
1.2MB

Download
memory/4604-45-0x00007FFE70605000-0x00007FFE70606000-memory.dmp

Filesize
4KB

Download
memory/4604-46-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-47-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-48-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download
memory/4604-49-0x00007FFE70350000-0x00007FFE70CF1000-memory.dmp

Filesize
9.6MB

Download