Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2025, 07:26

General

  • Target

    0ab83d1d58d0322d45d43cbd384ae714276e0d26c41324532193755fb91ecae4.exe

  • Size

    75KB

  • MD5

    ae4fe08b726c15c514d101e4e2973b7a

  • SHA1

    b253bbacd42f930c2a88735b11bee55fd273a198

  • SHA256

    0ab83d1d58d0322d45d43cbd384ae714276e0d26c41324532193755fb91ecae4

  • SHA512

    41c312ed775cc0c8796dc29bf0414fa1c0f5eb85d77f866bb2faa441ea822eb36c45b9650217dc0f1a24dd608bf8071b876d894dbf5fa126ecb3beda3750ce4e

  • SSDEEP

    1536:5L5lxcQxgr9BcXzfGQz0/m4QdQiWC378JztYtfBpf4p7WtX4:blSQxgr9eXzd4/mxKIm+t3JI

Malware Config

Signatures

  • Blocklisted process makes network request 15 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ab83d1d58d0322d45d43cbd384ae714276e0d26c41324532193755fb91ecae4.exe
    "C:\Users\Admin\AppData\Local\Temp\0ab83d1d58d0322d45d43cbd384ae714276e0d26c41324532193755fb91ecae4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 -n 2&c:\adwnerli.exe "C:\Users\Admin\AppData\Local\Temp\0ab83d1d58d0322d45d43cbd384ae714276e0d26c41324532193755fb91ecae4.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:372
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3812
      • \??\c:\adwnerli.exe
        c:\adwnerli.exe "C:\Users\Admin\AppData\Local\Temp\0ab83d1d58d0322d45d43cbd384ae714276e0d26c41324532193755fb91ecae4.exe"
        3⤵
        • Deletes itself
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3108
        • \??\c:\windows\SysWOW64\rundll32.exe
          c:\windows\system32\rundll32.exe "c:\raksf\hkqcv.dll",GetWindowClass c:\adwnerli.exe
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Adds Run key to start application
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4796
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\windows\SysWOW64\rundll32.exe "c:\raksf\hkqcv.dll",GetWindowClass
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4416
    • \??\c:\windows\SysWOW64\rundll32.exe
      c:\windows\SysWOW64\rundll32.exe "c:\raksf\hkqcv.dll",GetWindowClass
      2⤵
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1260
      • \??\c:\windows\SysWOW64\cmd.exe
        cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\raksf"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\adwnerli.exe

          Filesize

          75KB

          MD5

          1f249d240b18194a61db12169f208e38

          SHA1

          3930a47a59b824b5d4b521f9df4c1506532fd055

          SHA256

          cebc3343d395c69212b830060456491a17c852fc83a95fcecbcd40510a7520b3

          SHA512

          400527aea42095ba663c51a17399ab40daf03ae09d31744a698adbb429509ad1877b04b41f57968ce2ff5c7ada93e17add36ca3592993abac9054a42b6dd2e16

        • \??\c:\raksf\hkqcv.dll

          Filesize

          46KB

          MD5

          a3fd41430ddcaa55fde840788925406a

          SHA1

          dbdd87f5c1bbf6a6f44c2e2c4744675d5e4e75c2

          SHA256

          f57f9e54f4774c2b944fb070ae0c2a02cbb4b7686ab3207544c3ccaff0ff3dd9

          SHA512

          23109572cfc9a282ea3ec84d93bfe02303d27f365ad2d9f47f6234f91da14c64f80133cc5e49746dfcb65d2454b7e7c13eff59ba4bbc18e09d2fb1c630ba59c9

        • memory/1260-15-0x0000000010000000-0x000000001002E000-memory.dmp

          Filesize

          184KB

        • memory/1860-0-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/1860-1-0x0000000000418000-0x0000000000419000-memory.dmp

          Filesize

          4KB

        • memory/1860-3-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/3108-7-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/3108-10-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

        • memory/4796-13-0x0000000010000000-0x000000001002E000-memory.dmp

          Filesize

          184KB

        • memory/4796-16-0x0000000010000000-0x000000001002E000-memory.dmp

          Filesize

          184KB