Analysis
-
max time kernel
118s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 01:29
Behavioral task
behavioral1
Sample
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
Resource
win10v2004-20241007-en
General
-
Target
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
-
Size
102KB
-
MD5
0e540262593387d5ef74e5ea9b1cf920
-
SHA1
9b2b9467a84d4696820879a5e1dc229584770de0
-
SHA256
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bf
-
SHA512
ca9c4815a571c27a68ddafdeec0523741639e477e6df95da04be035812b5d2990cc186264fbf10dbd45905b4a140bad97c454b9e90b0bcdc7abf2139f85fdec0
-
SSDEEP
3072:xFphTfm1UC7AdYzrV+Dljy/32ubwZZqJ:FhTfmuCkdYzrVolu/J0ZZ
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
WindowsService.exeWindowsService.exeWindowsService.exepid process 3336 WindowsService.exe 348 WindowsService.exe 1896 WindowsService.exe -
Loads dropped DLL 5 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exepid process 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exeWindowsService.exedescription pid process target process PID 2100 set thread context of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 3336 set thread context of 348 3336 WindowsService.exe WindowsService.exe PID 3336 set thread context of 1896 3336 WindowsService.exe WindowsService.exe -
Processes:
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2100-27-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2100-25-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2100-286-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/3092-444-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2100-450-0x0000000000400000-0x000000000043B000-memory.dmp upx \Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe upx behavioral1/memory/3336-493-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/3092-496-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3092-1049-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3336-1047-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/348-1036-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3336-1035-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/348-1054-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.execmd.exereg.exeWindowsService.exeWindowsService.exeWindowsService.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WindowsService.exedescription pid process Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe Token: SeDebugPrivilege 348 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exeWindowsService.exeWindowsService.exepid process 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 3336 WindowsService.exe 348 WindowsService.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.execmd.exeWindowsService.exedescription pid process target process PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 2100 wrote to memory of 3092 2100 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe PID 3092 wrote to memory of 3260 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 3092 wrote to memory of 3260 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 3092 wrote to memory of 3260 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 3092 wrote to memory of 3260 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe cmd.exe PID 3260 wrote to memory of 3312 3260 cmd.exe reg.exe PID 3260 wrote to memory of 3312 3260 cmd.exe reg.exe PID 3260 wrote to memory of 3312 3260 cmd.exe reg.exe PID 3260 wrote to memory of 3312 3260 cmd.exe reg.exe PID 3092 wrote to memory of 3336 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 3092 wrote to memory of 3336 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 3092 wrote to memory of 3336 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 3092 wrote to memory of 3336 3092 48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 348 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe PID 3336 wrote to memory of 1896 3336 WindowsService.exe WindowsService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\BNROC.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:348 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
102KB
MD514fa923440f4f8ed41957128c11bc64f
SHA12249d4d186fd68542785798c37c34965b651a7ab
SHA256b457539bf4cfcaa32185f6899cbdfb43478df7ca031536532bd3e0c10ce18994
SHA51230d8effa49ed51a2262992635d9559da8a16fa10c031ed8831e83b9573ac74aef25be91a71e2d43bf9026132b493ade456b884d8988daf9c6d78a6c376ccebf4