4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2022 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
Size

359KB
MD5

5d7ac5e2662513c8a93ca5fceac73e12
SHA1

b90626d98e02a1dd56a3a4b0d1155f042216d75f
SHA256

4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7
SHA512

77be7d2a5084ad7ab5d8cc6fc87de21f8cb822c132ae910187122b0037d0bdc607e8a5636c3c686d075ca42435a7b0ee1c47eb5f6b89f4772193d29157f9f616

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4452-131-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/4452-133-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/4452-134-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/4452-136-0x0000000000400000-0x00000000004D4000-memory.dmp	upx
behavioral2/memory/4452-137-0x0000000000400000-0x00000000004D4000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe

description	pid	process	target process
PID 2872 set thread context of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe

Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

3880 net.exe
Runs net.exe

pid	process
3880	net.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe

description	pid	process	target process
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 2872 wrote to memory of 4452	2872	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
PID 4452 wrote to memory of 3880	4452	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	net.exe
PID 4452 wrote to memory of 3880	4452	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	net.exe
PID 4452 wrote to memory of 3880	4452	4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
"C:\Users\Admin\AppData\Local\Temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872
- \??\c:\users\admin\appdata\local\temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe
  "c:\users\admin\appdata\local\temp\4fc70d8a6ad7e1f293c66a19b926552d90dfcb08de52d7193a01899c9ccf99e7.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\net.exe
    net.exe view
    3⤵
    - Discovers systems in the same network
    PID:3880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3880-135-0x0000000000000000-mapping.dmp

Download
memory/4452-130-0x0000000000000000-mapping.dmp

Download
memory/4452-131-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4452-133-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4452-134-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4452-136-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4452-137-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download