d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe
Size

91KB
MD5

48f905e1cd97ea77e2a6b9f94d7b3825
SHA1

d77add63ebdd02735900951bcf3ecbf39741c955
SHA256

d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f
SHA512

1ddf5aa9d05670d989324970022546deeabb0487d8b3442a845058175e8d7d35b1d06e798548f0ada930033966f48c8bd667c5201acb95dad689bdeba3e18246
SSDEEP

1536:MvqR1b5euw05m62+RSiy2tbijE1t656Kk0dofVJBBBBBBBBBBBBBBBBBBBBBBBB3:r7djz2aylX56HPBBBBBBBBBBBBBBBBBk

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/992-57-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/928-58-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/928-59-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\CurrentVersion\Modules\Update\Settings	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 928	992	d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe	27

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 928	992	d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe	27
PID 992 wrote to memory of 928	992	d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe	27
PID 992 wrote to memory of 928	992	d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe	27
PID 992 wrote to memory of 928	992	d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe	27
PID 992 wrote to memory of 928	992	d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe	27

C:\Users\Admin\AppData\Local\Temp\d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe
"C:\Users\Admin\AppData\Local\Temp\d482ea5a2a53d3686f5595bd5c200fcf2364e91f11a4aa0a4350edce6bc52d1f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Checks for any installed AV software in registry
  PID:928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Security Software Discovery

T1063

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/928-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/928-59-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/992-57-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download