e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf

Analysis

max time kernel
92s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExeFile (236).exe
Size

1.2MB
MD5

c361fe1dc05f5d90c1ce35e0d49b6338
SHA1

267aac6007a22ca4c17eabbfe4c71f3194b181d6
SHA256

e105e4778abd8cc1d35e0d6b1f0ad17994570ead16764f012270be94de740aaf
SHA512

a1f7a311e03af563d43a2f2d3820d6ac690c99f0edd0ae935df2018205b6e970d14017dd043fd22bc24e956ea483a21116fa1e5b5be4152d3d266a51b9c9d55e
SSDEEP

24576:qQ+JBjAObi4M2rIDTU4fmj6J/d5nTWzim9W7akhWFhepaLSbK:qQGBfbiyrIDovj6l+59W7aApat

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

svchost.comsvchost.com

pid process

2164 svchost.com
2776 svchost.com
Loads dropped DLL 3 IoCs

Processes:

cmd.exesvchost.comsvchost.com

pid process

1964 cmd.exe
2164 svchost.com
2776 svchost.com

pid	process
2164	svchost.com
2776	svchost.com

pid	process
1964	cmd.exe
2164	svchost.com
2776	svchost.com

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ExeFile (236).exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ExeFile (236).exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs
Payload decoded via CertUtil.
defense_evasion

Deobfuscate/Decode Files or Information
T1140

Processes:

cmd.execertutil.exe

pid process

1964 cmd.exe
2148 certutil.exe

pid	process
1964	cmd.exe
2148	certutil.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

ExeFile (236).execmd.execertutil.exesvchost.comsvchost.comPING.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExeFile (236).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

2544 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2544 PING.EXE
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

svchost.comsvchost.com

pid process

2164 svchost.com
2164 svchost.com
2164 svchost.com
2776 svchost.com
2776 svchost.com
2776 svchost.com
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

svchost.comsvchost.com

pid process

2164 svchost.com
2164 svchost.com
2164 svchost.com
2776 svchost.com
2776 svchost.com
2776 svchost.com

pid	process
2544	PING.EXE

pid	process
2544	PING.EXE

pid	process
2164	svchost.com
2164	svchost.com
2164	svchost.com
2776	svchost.com
2776	svchost.com
2776	svchost.com

pid	process
2164	svchost.com
2164	svchost.com
2164	svchost.com
2776	svchost.com
2776	svchost.com
2776	svchost.com

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ExeFile (236).execmd.exesvchost.comsvchost.com

description	pid	process	target process
PID 2072 wrote to memory of 1964	2072	ExeFile (236).exe	cmd.exe
PID 2072 wrote to memory of 1964	2072	ExeFile (236).exe	cmd.exe
PID 2072 wrote to memory of 1964	2072	ExeFile (236).exe	cmd.exe
PID 2072 wrote to memory of 1964	2072	ExeFile (236).exe	cmd.exe
PID 1964 wrote to memory of 2148	1964	cmd.exe	certutil.exe
PID 1964 wrote to memory of 2148	1964	cmd.exe	certutil.exe
PID 1964 wrote to memory of 2148	1964	cmd.exe	certutil.exe
PID 1964 wrote to memory of 2148	1964	cmd.exe	certutil.exe
PID 1964 wrote to memory of 2164	1964	cmd.exe	svchost.com
PID 1964 wrote to memory of 2164	1964	cmd.exe	svchost.com
PID 1964 wrote to memory of 2164	1964	cmd.exe	svchost.com
PID 1964 wrote to memory of 2164	1964	cmd.exe	svchost.com
PID 2164 wrote to memory of 2776	2164	svchost.com	svchost.com
PID 2164 wrote to memory of 2776	2164	svchost.com	svchost.com
PID 2164 wrote to memory of 2776	2164	svchost.com	svchost.com
PID 2164 wrote to memory of 2776	2164	svchost.com	svchost.com
PID 1964 wrote to memory of 2544	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2544	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2544	1964	cmd.exe	PING.EXE
PID 1964 wrote to memory of 2544	1964	cmd.exe	PING.EXE
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com
PID 2776 wrote to memory of 2564	2776	svchost.com	svchost.com

C:\Users\Admin\AppData\Local\Temp\ExeFile (236).exe
"C:\Users\Admin\AppData\Local\Temp\ExeFile (236).exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c <nul set /p ="M" > svchost.com & type QEZEl.com >> svchost.com & del QEZEl.com & certutil -decode LucqD.com C & svchost.com C & ping 127.0.0.1 -n 3
  2⤵
  - Loads dropped DLL
  - Deobfuscate/Decode Files or Information
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\certutil.exe
    certutil -decode LucqD.com C
    3⤵
    - Deobfuscate/Decode Files or Information
    - System Location Discovery: System Language Discovery
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
    svchost.com C
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com C
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com
        5⤵
        
        PID:2564
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\C

Filesize
451KB

MD5
bcf0e243c2e927150dba715b423bad97

SHA1
3f9c1197703f46251d9f46d719e6dfb173b0cc9f

SHA256
f4a6970fd8ae434109374ae82915ab1047b266ee38420b269b4c7e6ef600fe10

SHA512
ef4b43b2fb8c6631b6f39247d5157f7f1c1bb3630502d9d74ea6d711fbd64126f9fe656238f3405f265a90829ca211f061f1d24fe14fb1e4adad498a160b4b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LucqD.com

Filesize
620KB

MD5
773a6c4f5b9eb23e52553f3d6af76e27

SHA1
7bd5a11cb1d9d48ed62fdc892c1b161221fc4fdb

SHA256
400c564fc93ba19029944a3ba5ecbac8ee2a5d3fe95a9b4320286143fdf39af7

SHA512
8c65bb539e8caa8e9dde2bfe641ce08e4fb6f14d7ce9bccaa92429a5cf8eb625bc474cecf6092fc282a4dc3aeb55c07ebb27f084e0ca39e4ba2b4e04077d5563

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OYeSG.com

Filesize
200KB

MD5
d825cdf4d339b91407067bf4d85f973d

SHA1
c21453bdd299451727393a1aa48daf0697070973

SHA256
2813f8d17e3d6cb808e351532f6d38beeb4e5d708ec28c37953bcf2229b840f4

SHA512
82775b46146439a49a332c96cdcf3efe7e34366e13dc7423ec6fd793b6089ec5c89edcb5bcb1fd8265e8c9d099059a9f2d1a4f0e40862957db2600967aaf7487

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QEZEl.com

Filesize
921KB

MD5
df6fbc5de331f39be67e2b343ff02083

SHA1
2791147f5aba7d5242d531f0444695b9fecb3c42

SHA256
ccefe3c453a32c04dd03e835879aceae0b96e7d25359dc05a8cfa7a880c21936

SHA512
35e1b55975104e9ddf24fc2842848f63c954f6e69bf8a4df370caaad43ff01f259fbd4e96e45bcbd2287192551afa3df5f9ad8726a3331d80a9c53fa558bf8a9

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.com

Filesize
921KB

MD5
78ba0653a340bac5ff152b21a83626cc

SHA1
b12da9cb5d024555405040e65ad89d16ae749502

SHA256
05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

SHA512
efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

Download Submit
memory/2564-23-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-22-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-21-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-24-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-36-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-35-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-52-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-50-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-49-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-47-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-45-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-44-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-42-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-40-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-39-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-99-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-34-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-94-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-93-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-91-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-87-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-85-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-83-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-31-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-81-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-80-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-30-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-78-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-76-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-74-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-29-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-70-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-66-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-65-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-63-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-61-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-59-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-57-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-56-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-26-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-51-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-48-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-25-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-46-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-43-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-41-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-38-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-37-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-98-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-95-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-33-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-90-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-88-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-84-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-32-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-82-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-79-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-77-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-73-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-71-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-68-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-28-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-27-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download
memory/2564-54-0x0000000000A90000-0x0000000001A90000-memory.dmp

Filesize
16.0MB

Download