Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/07/2025, 07:21

General

  • Target

    e6b4312aa2a3037519e99ab278c9bdbfcc130ce3a77d53f101b8bea9c9eed1f5.exe

  • Size

    76KB

  • MD5

    ca96a8ebe967d7fb665d42f2e65a55d4

  • SHA1

    573948d09c43e86ba1672b1659814d4d074dda03

  • SHA256

    e6b4312aa2a3037519e99ab278c9bdbfcc130ce3a77d53f101b8bea9c9eed1f5

  • SHA512

    730fee4107d8de1b8dedd3ea163eca21ab97e7bd336812bfcc414f4d4ba634554924a26eeeb97e3c8c00a449d21877cf207c35c0e458a38915233d581ac8786b

  • SSDEEP

    1536:5L5lxcQxgr9BcXzfGQz0/m4QdQiWC378JztYtfBpf4p7WtX44:blSQxgr9eXzd4/mxKIm+t3JI4

Malware Config

Signatures

  • Blocklisted process makes network request 15 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6b4312aa2a3037519e99ab278c9bdbfcc130ce3a77d53f101b8bea9c9eed1f5.exe
    "C:\Users\Admin\AppData\Local\Temp\e6b4312aa2a3037519e99ab278c9bdbfcc130ce3a77d53f101b8bea9c9eed1f5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 -n 2&c:\uzczz.exe "C:\Users\Admin\AppData\Local\Temp\e6b4312aa2a3037519e99ab278c9bdbfcc130ce3a77d53f101b8bea9c9eed1f5.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3844
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2132
      • \??\c:\uzczz.exe
        c:\uzczz.exe "C:\Users\Admin\AppData\Local\Temp\e6b4312aa2a3037519e99ab278c9bdbfcc130ce3a77d53f101b8bea9c9eed1f5.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5652
        • \??\c:\windows\SysWOW64\rundll32.exe
          c:\windows\system32\rundll32.exe "c:\xdgdt\uhrbg.dll",GetWindowClass c:\uzczz.exe
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Adds Run key to start application
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3172
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\SysWOW64\rundll32.exe "c:\xdgdt\uhrbg.dll",GetWindowClass
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4576
    • \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\SysWOW64\rundll32.exe "c:\xdgdt\uhrbg.dll",GetWindowClass
      2⤵
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:728
      • \??\c:\windows\SysWOW64\cmd.exe
        cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xdgdt"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3972
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:5004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\uzczz.exe

          Filesize

          76KB

          MD5

          f70959a74d140e37d0e78141ab782e1a

          SHA1

          a47c644551d2060cc67489f6552e0d30bb4d4ade

          SHA256

          b87e7efea9c7716a31c300c6bb9fa856e2b71b73832e38f27e37117675a400cf

          SHA512

          4b431c03ff23803ea107b40b2e944f74dc77f0aed176f485da788eca1aac02dfde3ff78661a2cf1212706da32c0382f4b2fb3358aca76ff7faa4269110a27019

        • \??\c:\xdgdt\uhrbg.dll

          Filesize

          46KB

          MD5

          a3fd41430ddcaa55fde840788925406a

          SHA1

          dbdd87f5c1bbf6a6f44c2e2c4744675d5e4e75c2

          SHA256

          f57f9e54f4774c2b944fb070ae0c2a02cbb4b7686ab3207544c3ccaff0ff3dd9

          SHA512

          23109572cfc9a282ea3ec84d93bfe02303d27f365ad2d9f47f6234f91da14c64f80133cc5e49746dfcb65d2454b7e7c13eff59ba4bbc18e09d2fb1c630ba59c9

        • memory/728-16-0x0000000010000000-0x000000001002E000-memory.dmp

          Filesize

          184KB

        • memory/2780-0-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/2780-1-0x0000000000418000-0x0000000000419000-memory.dmp

          Filesize

          4KB

        • memory/2780-3-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/3172-13-0x0000000010000000-0x000000001002E000-memory.dmp

          Filesize

          184KB

        • memory/3172-14-0x0000000010001000-0x000000001001E000-memory.dmp

          Filesize

          116KB

        • memory/3172-17-0x0000000010000000-0x000000001002E000-memory.dmp

          Filesize

          184KB

        • memory/3172-18-0x0000000010001000-0x000000001001E000-memory.dmp

          Filesize

          116KB

        • memory/5652-7-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/5652-10-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB