Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
General
-
Target
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
-
Size
390KB
-
MD5
8c64181ff0dc12c87e443aae94bf6650
-
SHA1
e91d7ebd17912785caa3e71ef1571dc01b1cd854
-
SHA256
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5
-
SHA512
4854565b054297dffc13b659a53059ee8731dca02f3027501254551cb4af20b68fb121d03e528151cf910238b49bf00a3827e74e4bb68faf85ebc50d02ad5c17
-
SSDEEP
12288:ef/X4NTn/xVkNG+w+9OqFoK323qdQYKU3:EXATn/xVkNg+95vdQa
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows 1 IoCs
Processes:
resource yara_rule behavioral2/files/0x000b000000023b77-17.dat mimikatz -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe -
Executes dropped EXE 1 IoCs
Processes:
8E36.tmppid Process 4476 8E36.tmp -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid Process 2996 rundll32.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE rundll32.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe rundll32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf rundll32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_92812\javaws.exe rundll32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE rundll32.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe rundll32.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg rundll32.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\7z.exe rundll32.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4E6AEEAD-B62E-4CF8-80E5-2A66138AEFDE}\chrome_installer.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe rundll32.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe rundll32.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe rundll32.exe -
Drops file in Windows directory 4 IoCs
Processes:
rundll32.exe4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exedescription ioc Process File created C:\Windows\dllhost.dat rundll32.exe File created C:\Windows\dllcm.dat 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe File opened for modification C:\Windows\dllcm.dat rundll32.exe File created C:\Windows\dllcm rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exeschtasks.exe4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
rundll32.exe8E36.tmppid Process 2996 rundll32.exe 2996 rundll32.exe 4476 8E36.tmp 4476 8E36.tmp 4476 8E36.tmp 4476 8E36.tmp 4476 8E36.tmp 4476 8E36.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
rundll32.exe8E36.tmpdescription pid Process Token: SeShutdownPrivilege 2996 rundll32.exe Token: SeDebugPrivilege 2996 rundll32.exe Token: SeTcbPrivilege 2996 rundll32.exe Token: SeDebugPrivilege 4476 8E36.tmp -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exerundll32.execmd.exedescription pid Process procid_target PID 768 wrote to memory of 2996 768 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe 84 PID 768 wrote to memory of 2996 768 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe 84 PID 768 wrote to memory of 2996 768 4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe 84 PID 2996 wrote to memory of 1812 2996 rundll32.exe 86 PID 2996 wrote to memory of 1812 2996 rundll32.exe 86 PID 2996 wrote to memory of 1812 2996 rundll32.exe 86 PID 2996 wrote to memory of 4476 2996 rundll32.exe 88 PID 2996 wrote to memory of 4476 2996 rundll32.exe 88 PID 1812 wrote to memory of 1880 1812 cmd.exe 90 PID 1812 wrote to memory of 1880 1812 cmd.exe 90 PID 1812 wrote to memory of 1880 1812 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"C:\Users\Admin\AppData\Local\Temp\4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\dllcm.dat #12⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 17:363⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 17:364⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1880
-
-
-
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp" \\.\pipe\{BCECE8CB-B25D-43DE-B616-8FBF883E4892}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD57e37ab34ecdcc3e77e24522ddfd4852d
SHA138e2855e11e353cedf9a8a4f2f2747f1c5c07fcf
SHA25602ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
SHA5121b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587
-
Filesize
353KB
MD57c0747971df2d07ceca15f0edc0a9f6e
SHA14db833ba4ddf88c36d6956928721547e1e221c0d
SHA2564dd22017d6f77573cc0f4999d22b45f1d71e6435350d4a5654ee1e93fec30827
SHA512d5da33a23fa39441901b9f4cc08468692d076545ffd29c082982fde7e93bb27464445478a37629a47d56594fd019863a1de52573c47ccf8d2252eb2047f8606e