Analysis
-
max time kernel
4s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/11/2024, 14:05
Behavioral task
behavioral1
Sample
dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe
Resource
win10v2004-20241007-en
General
-
Target
dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe
-
Size
405KB
-
MD5
2ecdf709804ba16898ef685bc2c94740
-
SHA1
09604599e8a761a85198d823163b9e2995a67968
-
SHA256
dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1
-
SHA512
94728a1b711369570b0e969eb91223b4fed0d2c110cd321ecb566ea5ba36a81b9b0c8e190e70c8a02fec8ea5cd732f4b9c8e0c0b155f1cbb6e7a4468a223a123
-
SSDEEP
6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr6:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS
Malware Config
Signatures
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2088 set thread context of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 set thread context of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 -
resource yara_rule behavioral1/memory/2088-0-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2088-26-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2088-92-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2088-100-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2088-130-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2088-131-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1824-147-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2088-145-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1824-181-0x0000000003780000-0x00000000038AD000-memory.dmp upx behavioral1/files/0x0004000000004ed7-175.dat upx behavioral1/memory/1576-184-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1824-292-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1576-315-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/568-313-0x0000000000400000-0x000000000047B000-memory.dmp upx behavioral1/memory/1824-321-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1284-325-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/568-328-0x0000000000400000-0x000000000047B000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2724 reg.exe 2056 reg.exe 1516 reg.exe 2304 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe 2600 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 2600 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 2600 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 31 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32 PID 2088 wrote to memory of 1824 2088 dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe"C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe"C:\Users\Admin\AppData\Local\Temp\dc878d732bb3d91d563d1cd92590fc779d05158263d6461f694dbb1c69683ef1N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1824 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\EIYWF.bat" "3⤵PID:1908
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f4⤵PID:1940
-
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"3⤵PID:1576
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:2344
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:1284
-
-
C:\Windows\javaruntime.exe"C:\Windows\javaruntime.exe"4⤵PID:568
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:2040
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:2056
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f5⤵PID:2396
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:2972
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies registry key
PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f5⤵PID:3052
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies registry key
PID:2724
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124B
MD5163f8e838efe1d166ffff7408b814e28
SHA152fa0ccba649587e7d24d21d182657078fa6d028
SHA256dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
-
Filesize
405KB
MD582c26c77c8100c5dfb286424150f0757
SHA1bda17eb533b8742a190a8f2b30c9c2d2f36f920a
SHA2560ecbf96b406a4e0993efa8262a96172ba454dd7db6f88d2427ddbfcced3a6da1
SHA51249b1ba236c2e47eed35d3229a5fca7f697613b96fb10c62dda52244e4d603f5750354b09fad6c94d9fcc53ffac209314a1952d8e8454e1858384b6fa283901ca