Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28-10-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe
Resource
win10v2004-20241007-en
General
-
Target
66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe
-
Size
11.7MB
-
MD5
2e3c92b0fef03f9cf87c3dacd8bfe6dc
-
SHA1
65fccf614953d38a454138daf8449ee824a37cf2
-
SHA256
66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2
-
SHA512
0f037ed603392f718664dfd8465cc57642d47f5fea85f3e06fe0c4f235f91f76ebc8a7e70e23ac388cffcdd85e49051542d5ea0a12cd4f0242b6fccdfef699b9
-
SSDEEP
196608:NfDFV4lFoxZupaiSrZOH+eWRIStQvbd4r/JdsEKR+4WUAofZXDO1iUjGgKJ:NrsMTroHyRIzvbqroFR+4WDofZXD25Gv
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2780 Lkdcgznc.exe 1236 Lkdcgznc.exe 1188 Process not Found -
Loads dropped DLL 10 IoCs
pid Process 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 2780 Lkdcgznc.exe 1236 Lkdcgznc.exe 1236 Lkdcgznc.exe 1236 Lkdcgznc.exe 1236 Lkdcgznc.exe 1236 Lkdcgznc.exe 1236 Lkdcgznc.exe 1236 Lkdcgznc.exe 1188 Process not Found -
resource yara_rule behavioral1/files/0x000500000001a48f-119.dat upx behavioral1/memory/1236-121-0x000007FEF6900000-0x000007FEF6EE8000-memory.dmp upx behavioral1/memory/1236-124-0x000007FEF6900000-0x000007FEF6EE8000-memory.dmp upx -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0014000000015e9a-5.dat pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2780 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 30 PID 2492 wrote to memory of 2780 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 30 PID 2492 wrote to memory of 2780 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 30 PID 2492 wrote to memory of 2808 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 31 PID 2492 wrote to memory of 2808 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 31 PID 2492 wrote to memory of 2808 2492 66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe 31 PID 2780 wrote to memory of 1236 2780 Lkdcgznc.exe 33 PID 2780 wrote to memory of 1236 2780 Lkdcgznc.exe 33 PID 2780 wrote to memory of 1236 2780 Lkdcgznc.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe"C:\Users\Admin\AppData\Local\Temp\66dc12a854b4e1dc8b1a4d3517eea56a04234ce13ed6aa4642921322928c96c2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\Lkdcgznc.exe"C:\Users\Admin\AppData\Local\Temp\Lkdcgznc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\Lkdcgznc.exe"C:\Users\Admin\AppData\Local\Temp\Lkdcgznc.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Zfobfaqe.bat" "2⤵PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
877B
MD5cd480b40656a01015f5c7e16832d3384
SHA1c446c9cb3a534d9ea432916bbd04b466a07d4521
SHA256c2863c67203376c14e8f2c64e16f65185d2f1272c75fe9d6b43f301ad1181d64
SHA5120504e98fbb276374b9c3aa8edab36154b412934269d1cda99e8b0742c0f1071326cc3ad5e08e51446421dcedcce362ef6d51e22461a4267ed92f3abba0e87576
-
Filesize
21KB
MD5bcb8b9f6606d4094270b6d9b2ed92139
SHA1bd55e985db649eadcb444857beed397362a2ba7b
SHA256fa18d63a117153e2ace5400ed89b0806e96f0627d9db935906be9294a3038118
SHA512869b2b38fd528b033b3ec17a4144d818e42242b83d7be48e2e6da6992111758b302f48f52e0dd76becb526a90a2b040ce143c6d4f0e009a513017f06b9a8f2b9
-
Filesize
21KB
MD520ddf543a1abe7aee845de1ec1d3aa8e
SHA10eaf5de57369e1db7f275a2fffd2d2c9e5af65bf
SHA256d045a72c3e4d21165e9372f76b44ff116446c1e0c221d9cea3ab0a1134a310e8
SHA51296dd48df315a7eea280ca3da0965a937a649ee77a82a1049e3d09b234439f7d927d7fb749073d7af1b23dadb643978b70dcdadc6c503fe850b512b0c9c1c78dd
-
Filesize
21KB
MD54380d56a3b83ca19ea269747c9b8302b
SHA10c4427f6f0f367d180d37fc10ecbe6534ef6469c
SHA256a79c7f86462d8ab8a7b73a3f9e469514f57f9fe456326be3727352b092b6b14a
SHA5121c29c335c55f5f896526c8ee0f7160211fd457c1f1b98915bcc141112f8a730e1a92391ab96688cbb7287e81e6814cc86e3b057e0a6129cbb02892108bfafaf4
-
Filesize
21KB
MD52554060f26e548a089cab427990aacdf
SHA18cc7a44a16d6b0a6b7ed444e68990ff296d712fe
SHA2565ab003e899270b04abc7f67be953eaccf980d5bbe80904c47f9aaf5d401bb044
SHA512fd4d5a7fe4da77b0222b040dc38e53f48f7a3379f69e2199639b9f330b2e55939d89ce8361d2135182b607ad75e58ee8e34b90225143927b15dcc116b994c506
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
Filesize
11.8MB
MD548dff59b7f15117315a7d0a49604321b
SHA1a47b244b4933e9e0fa93782a345295a3ab8df48f
SHA256b93a8af14d02fa139ce8e00687cd31ef2c536956347857e9259a7e26be4a2929
SHA5128c589b8335f0e78d9547dcd8c7c3a93f6fdaefa7dcfb61d70dc53c8621385a1872b23862759bc892a566f9f58ce5e8f8a4c170fd8311cbdc5a3b431ed3af4ca1
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f