4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
19-07-2022 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
Size

359KB
MD5

5d7ac5e2662513c8a93ca5fceac73e12
SHA1

b90626d98e02a1dd56a3a4b0d1155f042216d75f
SHA256

4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7
SHA512

77be7d2a5084ad7ab5d8cc6fc87de21f8cb822c132ae910187122b0037d0bdc607e8a5636c3c686d075ca42435a7b0ee1c47eb5f6b89f4772193d29157f9f616

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-56-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/1728-58-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/1728-59-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/1728-62-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/1728-63-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/1728-65-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral1/memory/1728-66-0x0000000000400000-0x00000000004D4000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
240	net.exe

Runs net.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1776 wrote to memory of 1728	1776	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	28
PID 1728 wrote to memory of 240	1728	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	29
PID 1728 wrote to memory of 240	1728	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	29
PID 1728 wrote to memory of 240	1728	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	29
PID 1728 wrote to memory of 240	1728	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	29

C:\Users\Admin\AppData\Local\Temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
"C:\Users\Admin\AppData\Local\Temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776
- \??\c:\users\admin\appdata\local\temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
  "c:\users\admin\appdata\local\temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\net.exe
    net.exe view
    3⤵
    - Discovers systems in the same network
    PID:240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-55-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-56-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-58-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-59-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-62-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-63-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-65-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1728-66-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/1776-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download