ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805a

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe
Size

484KB
MD5

4a4c09d3cbef544cf8342e80d783c450
SHA1

cdb8cae2a8260dd78df6030edaa6d39ef21b8ec9
SHA256

ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805a
SHA512

ce80ed4806ed4251d8f78295f3dbf1a0d6b1cd3d8e2c6aa124fd4bda22b97fd848ea080a7affc5cd3b9ba56e4d026b393df2140b94d0b9e02c6f4245c8732714
SSDEEP

12288:2LPkCDt1EG2XVekhdeT/iKgVFdcuzb7EXS:2LPkQ1bqAHiXBn7ES

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1748	dcompugc.exe
2216	~A9D6.tmp
2820	dxdiocom.exe

Loads dropped DLL 3 IoCs

pid	Process
2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe
2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe
1748	dcompugc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\bitsburn = "C:\\Users\\Admin\\AppData\\Roaming\\MigAgMgr\\dcompugc.exe"	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dxdiocom.exe	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2436	WerFault.exe	28

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcompugc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxdiocom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1748	dcompugc.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE
2820	dxdiocom.exe
1240	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	dcompugc.exe
Token: SeShutdownPrivilege	1240	Explorer.EXE
Token: SeShutdownPrivilege	1240	Explorer.EXE
Token: SeShutdownPrivilege	1240	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1748	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	29
PID 2436 wrote to memory of 1748	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	29
PID 2436 wrote to memory of 1748	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	29
PID 2436 wrote to memory of 1748	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	29
PID 1748 wrote to memory of 2216	1748	dcompugc.exe	30
PID 1748 wrote to memory of 2216	1748	dcompugc.exe	30
PID 1748 wrote to memory of 2216	1748	dcompugc.exe	30
PID 1748 wrote to memory of 2216	1748	dcompugc.exe	30
PID 2216 wrote to memory of 1240	2216	~A9D6.tmp	20
PID 2436 wrote to memory of 2724	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	32
PID 2436 wrote to memory of 2724	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	32
PID 2436 wrote to memory of 2724	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	32
PID 2436 wrote to memory of 2724	2436	ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
- C:\Users\Admin\AppData\Local\Temp\ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe
  "C:\Users\Admin\AppData\Local\Temp\ad5f526760eb4bd991d1fc7c5babf7c96fd5ed484d1541855c087e2db438805aN.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Roaming\MigAgMgr\dcompugc.exe
    "C:\Users\Admin\AppData\Roaming\MigAgMgr"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\~A9D6.tmp
      1240 496136 1748 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 252
    3⤵
    - Program crash
    PID:2724

C:\Windows\SysWOW64\dxdiocom.exe
C:\Windows\SysWOW64\dxdiocom.exe -s
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~A9D6.tmp

Filesize
8KB

MD5
aac3165ece2959f39ff98334618d10d9

SHA1
020a191bfdc70c1fbd3bf74cd7479258bd197f51

SHA256
96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

SHA512
9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

Download Submit
\Users\Admin\AppData\Roaming\MigAgMgr\dcompugc.exe

Filesize
484KB

MD5
9df36327d8279cb26f6d9032c7c10239

SHA1
c46cefc4d1b2b1c7d79329b4ef5405d468a6932e

SHA256
c011adad116c9309566d2eb03aac7b6ef87268e3c3df10ab82c2e8a14a02db19

SHA512
2d0743a55fefc646c0915ecb8bb3442aea5296631084ef6a5d82b0a6eb30c41a63357dcad9db985f89ab18504fb3f5a825cfc7c91188adef3ffdb3ecfec81edb

Download Submit
memory/1240-27-0x0000000002BC0000-0x0000000002BCD000-memory.dmp

Filesize
52KB

Download
memory/1240-26-0x0000000002A30000-0x0000000002A36000-memory.dmp

Filesize
24KB

Download
memory/1240-20-0x0000000003FB0000-0x0000000004039000-memory.dmp

Filesize
548KB

Download
memory/1240-18-0x0000000003FB0000-0x0000000004039000-memory.dmp

Filesize
548KB

Download
memory/1240-17-0x0000000003FB0000-0x0000000004039000-memory.dmp

Filesize
548KB

Download
memory/1748-13-0x00000000000E0000-0x00000000000E6000-memory.dmp

Filesize
24KB

Download
memory/1748-12-0x0000000000280000-0x0000000000303000-memory.dmp

Filesize
524KB

Download
memory/2436-0-0x0000000000320000-0x00000000003A3000-memory.dmp

Filesize
524KB

Download
memory/2436-36-0x0000000000320000-0x00000000003A3000-memory.dmp

Filesize
524KB

Download
memory/2820-32-0x0000000000080000-0x0000000000086000-memory.dmp

Filesize
24KB

Download
memory/2820-31-0x00000000002B0000-0x0000000000333000-memory.dmp

Filesize
524KB

Download
memory/2820-34-0x0000000000090000-0x0000000000096000-memory.dmp

Filesize
24KB

Download
memory/2820-35-0x0000000000080000-0x0000000000086000-memory.dmp

Filesize
24KB

Download
memory/2820-37-0x0000000000080000-0x0000000000086000-memory.dmp

Filesize
24KB

Download