bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe
Size

404KB
MD5

a123177ae68ca2008b934820b1c5277f
SHA1

7bde3ecdf4e089c796285964f99cc7b1e7bc9840
SHA256

bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f
SHA512

ba07443c22eb316c05d943040a7c41c6c28f0d475bf7e3c893398789dfb449e9711d3a26b46005468a9ee98d5eca5e6eb0689b6ae926411dfa8bee570b98b45b
SSDEEP

6144:4jlYKRF/LReWAsUys1X5N752ka8JryxNktWHoo3BC9U2J:4jauDReWG1752khKNktmBC

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1960	krqad.exe

Loads dropped DLL 2 IoCs

pid	Process
3044	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe
3044	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\krqad.exe"	krqad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	krqad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1960	3044	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe	30
PID 3044 wrote to memory of 1960	3044	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe	30
PID 3044 wrote to memory of 1960	3044	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe	30
PID 3044 wrote to memory of 1960	3044	bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe	30

C:\Users\Admin\AppData\Local\Temp\bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe
"C:\Users\Admin\AppData\Local\Temp\bca84db22be2e256228a12351e43f656937ca152a5ff16b6ad5c15327fdd780f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044
- C:\ProgramData\krqad.exe
  "C:\ProgramData\krqad.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe

Filesize
404KB

MD5
fd43b801f5f1c76f9f0ce5326355990d

SHA1
1c83ffe672a861cfd0dcfb027368c3390e48b716

SHA256
90d7d1ebd61062386034b4ef45da93cdff1a93e385116ac395cc92c83f1de077

SHA512
a65026aa7b15a6149678c403b5a7a43ce34de9e00706205bdcc0cad9cf7574679de618f8ca25f49123ca30805853dd20b8c0cdb8bd9126cb8b4d7d003cb34413

Download Submit
C:\ProgramData\Saaaalamm\Mira.h

Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\krqad.exe

Filesize
267KB

MD5
d094da466711cb44475f010dea0792ff

SHA1
b9a50f0563b017b9c21cbaf0ce4035cb1a2166b0

SHA256
548d49200cf0b6621521b4e7247e24d4a344629d4acffec6d7f8eebf134402e5

SHA512
f7c366b765c5c47be56fa35e7c11e6e5b60a8c0ad74bc8b24bdb2fc53524931100ee8e146abcefe7acf55fabb329f71696c1078112c9efc0d6545be80ab5a9e6

Download Submit
memory/1960-131-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3044-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3044-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3044-11-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads