9cc76ea5d1c6c3e50c7af7449c872b4ee339c121971de916f7881239328d58c9

Analysis

max time kernel
143s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2022, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

golfasian.exe
Size

29KB
MD5

708f0916f07e1a60c963194efb4eacb6
SHA1

f6a349de5f144458f767cf50a8f579918f686d8b
SHA256

6aee7c51b1b8f1fcabb4de181f82ed74acf8d4a6891245d3e13c70b6e8c86e01
SHA512

fbc4b33088575e5e93199ff21ad6c5d57dd912555cdc6a89fd22878e782d1828268324636b16415feab27137b3621776edc73657baa980ba7807e8f1e93fcb74
SSDEEP

768:SCIqdH/k1ZVcT194jp4dl95/2gtFLsUDwegSA6:SNqaLV8a655cUD+6

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2668-123-0x0000000000800000-0x000000000080D000-memory.dmp	upx
behavioral2/memory/2668-165-0x0000000000800000-0x000000000080D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe"	golfasian.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\WinRAR.v.3.2.and.key.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\Winamp 5.0 (en).exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\Winamp 5.0 (en) Crack.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ICQ 4 Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\en-US\index.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ICQ 4 Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\Harry Potter.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\index.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\WinRAR.v.3.2.and.key.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\Winamp 5.0 (en) Crack.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ICQ 4 Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ICQ 4 Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\WinRAR.v.3.2.and.key.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\WinRAR.v.3.2.and.key.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\WinRAR.v.3.2.and.key.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\Kazaa Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\Winamp 5.0 (en) Crack.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\Winamp 5.0 (en) Crack.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\WinRAR.v.3.2.and.key.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\Winamp 5.0 (en).com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Winamp 5.0 (en).ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\Winamp 5.0 (en) Crack.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\Winamp 5.0 (en) Crack.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ICQ 4 Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\Winamp 5.0 (en).exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\WinRAR.v.3.2.and.key.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\WinRAR.v.3.2.and.key.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\Kazaa Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\index.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\index.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\index.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\en-US\WinRAR.v.3.2.and.key.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\WinRAR.v.3.2.and.key.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Harry Potter.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\WinRAR.v.3.2.and.key.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\index.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\ICQ 4 Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Winamp 5.0 (en).exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\TextConv\Winamp 5.0 (en).com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\Kazaa Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\WinRAR.v.3.2.and.key.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\Kazaa Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\Kazaa Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ICQ 4 Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ICQ 4 Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\Winamp 5.0 (en) Crack.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\Kazaa Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ICQ 4 Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\Kazaa Lite.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\ICQ 4 Lite.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Harry Potter.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\WinRAR.v.3.2.and.key.exe	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\Kazaa Lite.ShareReactor.com	golfasian.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\ICQ 4 Lite.exe	golfasian.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\lsass.exe	golfasian.exe
File created	C:\Windows\lsass.exe	golfasian.exe

C:\Users\Admin\AppData\Local\Temp\golfasian.exe
"C:\Users\Admin\AppData\Local\Temp\golfasian.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2668-116-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-117-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-118-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-119-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-120-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-121-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-122-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-123-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download
memory/2668-124-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-125-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-126-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-127-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-128-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-129-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-130-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-131-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-132-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-133-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-134-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-135-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-136-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-137-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-138-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-139-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-140-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-141-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-142-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-143-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-144-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-145-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-146-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-147-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-148-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-149-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-150-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-151-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-152-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-153-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-154-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-155-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-156-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-157-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-158-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-160-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-159-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-161-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-162-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-163-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-164-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-165-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download
memory/2668-166-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download
memory/2668-167-0x00000000779A0000-0x0000000077B2E000-memory.dmp

Filesize
1.6MB

Download