Analysis
- max time kernel
140s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
21/10/2022, 00:06
General
- Target d3acae4ea6c196bae92b64f5a8fbf0d8d032151dd96c328db6cd4bcb09f2c2a0.exe
- Size 2.8MB
- Sample221021-adwmpacec5
- SHA256 d3acae4ea6c196bae92b64f5a8fbf0d8d032151dd96c328db6cd4bcb09f2c2a0
Malware Config
Signatures
- ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 1 IoCs
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookAW 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3acae4ea6c196bae92b64f5a8fbf0d8d032151dd96c328db6cd4bcb09f2c2a0.exe"C:\Users\Admin\AppData\Local\Temp\d3acae4ea6c196bae92b64f5a8fbf0d8d032151dd96c328db6cd4bcb09f2c2a0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
-
C:\4a8e6313.exeC:\4a8e6313.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
4a8e6313.exe
4a8e6313.exe
Infotmp.txt
6D8302BC.tmp
6D8302BC.tmp
FastUserSwitchingCompatibility.dll
fastuserswitchingcompatibility.dll
memory/3816-137-0x00000000000E0000-0x0000000000104000-memory.dmp
memory/3816-136-0x00000000000E0000-0x0000000000104000-memory.dmp
memory/3816-141-0x0000000002670000-0x0000000006670000-memory.dmp
memory/3816-139-0x0000000002670000-0x0000000006670000-memory.dmp
memory/3816-138-0x00000000000E0000-0x0000000000104000-memory.dmp
memory/4328-132-0x0000000000400000-0x00000000006D8000-memory.dmp
memory/4328-140-0x0000000000400000-0x00000000006D8000-memory.dmp
memory/4328-150-0x00000000753D0000-0x00000000753F4000-memory.dmp
memory/4328-151-0x00000000753D0000-0x00000000753F4000-memory.dmp
memory/4328-152-0x00000000753D0000-0x00000000753F4000-memory.dmp
memory/4328-153-0x0000000000400000-0x00000000006D8000-memory.dmp
memory/4328-154-0x00000000753D0000-0x00000000753F4000-memory.dmp
memory/4920-147-0x0000000075320000-0x0000000075344000-memory.dmp
memory/4920-145-0x0000000075320000-0x0000000075344000-memory.dmp
memory/4920-144-0x0000000075320000-0x0000000075344000-memory.dmp