Overview

overview

8

Static

static

e4d610a0b4...d6.exe

windows7-x64

8

e4d610a0b4...d6.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    187s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2022, 02:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e4d610a0b4d96ba16a565695d3217216b45acd66fa647081a46ad77dc7b795d6.exe

  • Size

    418KB

  • MD5

    4865003b4393c7c2cff41dc5acc37b99

  • SHA1

    6712b5fe91d6a3e3ff590c242eb8d3b2cd9a69d1

  • SHA256

    e4d610a0b4d96ba16a565695d3217216b45acd66fa647081a46ad77dc7b795d6

  • SHA512

    57ce4fbf4b5af17713933e157da60f9c6fca9f56c2ffe49eb971c3a780fe1b4f6f1ed551fa0b875c244f7592c954b35c14b8e89bf60637d91c7c2ff2e5a825c8

  • SSDEEP

    12288:BU0x2XOo3+GOrFhyzUfdSWJpzqt9kpIsce:B6XOo3mFIzyEWJlq7T

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4d610a0b4d96ba16a565695d3217216b45acd66fa647081a46ad77dc7b795d6.exe
    "C:\Users\Admin\AppData\Local\Temp\e4d610a0b4d96ba16a565695d3217216b45acd66fa647081a46ad77dc7b795d6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe
      "C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe" BOMBARDAMAXIMUM
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1652
    • C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe
      "C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe" "C:\Users\Admin\AppData\Local\Temp\e4d610a0b4d96ba16a565695d3217216b45acd66fa647081a46ad77dc7b795d6.exe"
      2⤵
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1236

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512
    Filesize

    192B

    MD5

    82692f38a75c1d4236a73e7144292238

    SHA1

    c24da6f74c77db4f5476d70b1869fe43d2aa6d93

    SHA256

    1521deeb32441cca73fa48ca777c9e175afe1b2bfb2188ed38dd0a9587acb7c5

    SHA512

    02e98d4329b854308f8ce4177e470a85dc1a9f368fe553862e0ae08b6b770e8ad875e2ff3361fb1576b5aeda88f38a696e4005935ce7d6c002d283cd4c6777ff

    Download Submit

  • C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe
    Filesize

    418KB

    MD5

    7df898f319fdceadeb350b351aca307b

    SHA1

    402ec8136260e03b9917f790aacf22c3f300af96

    SHA256

    30cd2cb2e9c3d4e405dd83cd81054e81b0823596d6865ed8207380486de19033

    SHA512

    53ddfb9da787d99cf814882374d8ac611cee37ce5972130d853a2ac49ce539000543796d2a73e4f10683040fa871a22f35449126443d602d10e474fb4d381a23

    Download Submit

  • C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe
    Filesize

    418KB

    MD5

    7df898f319fdceadeb350b351aca307b

    SHA1

    402ec8136260e03b9917f790aacf22c3f300af96

    SHA256

    30cd2cb2e9c3d4e405dd83cd81054e81b0823596d6865ed8207380486de19033

    SHA512

    53ddfb9da787d99cf814882374d8ac611cee37ce5972130d853a2ac49ce539000543796d2a73e4f10683040fa871a22f35449126443d602d10e474fb4d381a23

    Download Submit

  • C:\ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe
    Filesize

    418KB

    MD5

    7df898f319fdceadeb350b351aca307b

    SHA1

    402ec8136260e03b9917f790aacf22c3f300af96

    SHA256

    30cd2cb2e9c3d4e405dd83cd81054e81b0823596d6865ed8207380486de19033

    SHA512

    53ddfb9da787d99cf814882374d8ac611cee37ce5972130d853a2ac49ce539000543796d2a73e4f10683040fa871a22f35449126443d602d10e474fb4d381a23

    Download Submit

  • \ProgramData\nCb24512dJlFh24512\nCb24512dJlFh24512.exe
    Filesize

    418KB

    MD5

    7df898f319fdceadeb350b351aca307b

    SHA1

    402ec8136260e03b9917f790aacf22c3f300af96

    SHA256

    30cd2cb2e9c3d4e405dd83cd81054e81b0823596d6865ed8207380486de19033

    SHA512

    53ddfb9da787d99cf814882374d8ac611cee37ce5972130d853a2ac49ce539000543796d2a73e4f10683040fa871a22f35449126443d602d10e474fb4d381a23

    Download Submit

  • memory/1236-68-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/1376-56-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/1376-63-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/1376-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1376-55-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/1652-65-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download

  • memory/1652-69-0x0000000000400000-0x00000000004C8000-memory.dmp

    Filesize

    800KB

    Download