25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 00:02

Target

25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
Size

91KB
MD5

5f4721066441fb4298d28f76e3912027
SHA1

d3d0fa4499ff45b2902799fabb67d59a3a98ac17
SHA256

25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed
SHA512

83d458fd05e07a47aba1cb0b531c7f12ce81db25d8a518c288ef49dfa2f82b9c1a0cda411b1497f9d1db4e3aef2734a16cd62d101ded909dae7ce2814d605a4c
SSDEEP

1536:XLys3eF+KtScNqRLG5bxH1Up7VNXsV049AVXl/vqsXUqAehqRDOq4OZZZLlOjib3:bysI+ypoQnUp7VhsVWVXl/SsXUx5RDEm

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
1260	Grass.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1632-57-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1632	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\Gsoftb\Grass.exe	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
File opened for modification	\??\c:\program files\Gsoftb\Grass.exe	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1632	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1260	1632	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	28
PID 1632 wrote to memory of 1260	1632	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	28
PID 1632 wrote to memory of 1260	1632	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	28
PID 1632 wrote to memory of 1260	1632	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	28

C:\Users\Admin\AppData\Local\Temp\25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
"C:\Users\Admin\AppData\Local\Temp\25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632
- \??\c:\program files\Gsoftb\Grass.exe
  "c:\program files\Gsoftb\Grass.exe" "c:\program files\Gsoftb\ik01.tmp" Fuckyou
  2⤵
  - Executes dropped EXE
  PID:1260

C:\Program Files\Gsoftb\Grass.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\Program Files\Gsoftb\Grass.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/1632-57-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download