Analysis
-
max time kernel
178s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 14:59
Static task
static1
Behavioral task
behavioral1
Sample
f4ec5e3d1c8ba823ffe99a85704db2de.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f4ec5e3d1c8ba823ffe99a85704db2de.exe
Resource
win10v2004-20240802-en
General
-
Target
f4ec5e3d1c8ba823ffe99a85704db2de.exe
-
Size
379KB
-
MD5
f4ec5e3d1c8ba823ffe99a85704db2de
-
SHA1
beab1d4c708e247acb025da51e8af82bd2c0cebe
-
SHA256
b5e0c038f3f6f225b402354a607411cf0e41317c4dda0f85f67a591ecc2d48d7
-
SHA512
b6194b6e9ce21019ddd82431050ef4b9fd91501f6a603e8fb6ea12ae5dfb7e7a70b712c01857ebbbf8704c70babd581c6f9d905382f382608131a5d5a8fe454e
-
SSDEEP
384:H+b0ZIrceK5eDKe5Teuek41UQFn0FWkorqVsiEsbTGETNkrMX4mT6h8CfskRpwKH:RZRiKFnQoWTxgPC3Yi3iPmbLDC
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4540 created 3576 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 56 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bdhtss = "C:\\Users\\Admin\\AppData\\Roaming\\Bdhtss.exe" f4ec5e3d1c8ba823ffe99a85704db2de.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4540 set thread context of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4ec5e3d1c8ba823ffe99a85704db2de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe Token: SeDebugPrivilege 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3252 InstallUtil.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89 PID 4540 wrote to memory of 3252 4540 f4ec5e3d1c8ba823ffe99a85704db2de.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\f4ec5e3d1c8ba823ffe99a85704db2de.exe"C:\Users\Admin\AppData\Local\Temp\f4ec5e3d1c8ba823ffe99a85704db2de.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD59b688ed61fe885a927fd6ccd1c5257ff
SHA1d5059a9aa9f216b452a4a57157aebf08e8555203
SHA2561fbea56703a183136e690de73ee4ce2e30ac7cb343d5e36f26db1cb3d3b22fc4
SHA512093104eaa7d32eafd233ff45f457cb7c62ee6026b7057ca2d2ca89778da08435976d78cda6232ade628498ad9f63562c906b72af8e80ac13490f70b427bdcf07