25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 00:02

Target

25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
Size

91KB
MD5

5f4721066441fb4298d28f76e3912027
SHA1

d3d0fa4499ff45b2902799fabb67d59a3a98ac17
SHA256

25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed
SHA512

83d458fd05e07a47aba1cb0b531c7f12ce81db25d8a518c288ef49dfa2f82b9c1a0cda411b1497f9d1db4e3aef2734a16cd62d101ded909dae7ce2814d605a4c
SSDEEP

1536:XLys3eF+KtScNqRLG5bxH1Up7VNXsV049AVXl/vqsXUqAehqRDOq4OZZZLlOjib3:bysI+ypoQnUp7VhsVWVXl/SsXUx5RDEm

Score

8^/10

upx

Executes dropped EXE 1 IoCs

pid	Process
2084	Grass.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4112-135-0x0000000000400000-0x0000000000436000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\Gsoftb\Grass.exe	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
File opened for modification	\??\c:\program files\Gsoftb\Grass.exe	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
4112	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2084	4112	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	86
PID 4112 wrote to memory of 2084	4112	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	86
PID 4112 wrote to memory of 2084	4112	25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe	86

C:\Users\Admin\AppData\Local\Temp\25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe
"C:\Users\Admin\AppData\Local\Temp\25db46ee599a1403d5a3b004266c0380dd0bca96edf290904623848c1642b3ed.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4112
- \??\c:\program files\Gsoftb\Grass.exe
  "c:\program files\Gsoftb\Grass.exe" "c:\program files\Gsoftb\ik01.tmp" Fuckyou
  2⤵
  - Executes dropped EXE
  PID:2084

C:\Program Files\Gsoftb\Grass.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
\??\c:\program files\Gsoftb\Grass.exe

Filesize
60KB

MD5
889b99c52a60dd49227c5e485a016679

SHA1
8fa889e456aa646a4d0a4349977430ce5fa5e2d7

SHA256
6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

SHA512
08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

Download Submit
memory/4112-135-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download