Resubmissions
14-02-2025 01:10
250214-bjsnnayne1 1014-02-2025 01:00
250214-bc5pmsymhw 1013-02-2025 05:01
250213-fnkwtstpgw 1013-02-2025 04:24
250213-e1kk6atmaz 1013-02-2025 04:08
250213-eqe8patkgx 812-02-2025 23:56
250212-3yzt3azrdx 1012-02-2025 23:44
250212-3rgd5szmbm 1012-02-2025 23:19
250212-3a9dlazkep 1012-02-2025 13:32
250212-qs211ssrfr 10Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-02-2025 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4363463463464363463463463.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4363463463464363463463463.exe
Resource
win10v2004-20250211-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4363463463464363463463463.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 13 2692 4363463463464363463463463.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 13 raw.githubusercontent.com 12 raw.githubusercontent.com -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4363463463464363463463463.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 4363463463464363463463463.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 4363463463464363463463463.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 4363463463464363463463463.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2180 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2692 4363463463464363463463463.exe Token: SeDebugPrivilege 2180 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe 2180 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:2276
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57861d1fcb4e9548d8bd1549279f2ec7d
SHA1bb264871951ba92ccadcb9a93259a5dd8ddff2ec
SHA2564dc2992de8268dc47a7ef68ecadb4c74d4bee11c433f783cce236cf43f2f115d
SHA5128d9851453ba836b74b2831d84196dc15487f6570561aa3c4b19d63540d30cd54f5edb69cbf2b11eaf33d4c9b94ebbb7d166110301e809c0d5e382f50b85accb6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b