5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a

Analysis

max time kernel
149s
max time network
136s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
Size

612KB
MD5

0d42a14f0381d2c190fd55765285ea4d
SHA1

9ee8cf590a2f7b1cd8d6ee472aa673d52afcf04c
SHA256

5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a
SHA512

f9608ac10b9a9c4c67ec4cb47c4afbb951f3f3c2e9fc814950a30e01bbd12ab0552c8c43405bb82137f56cae919590f163c1eef713ecd2eaf3d4f6bafeb3f3a7
SSDEEP

12288:rJ72o+xixStQ6nXiINpopakmtCiiFgvrv3K:X+xix+Q6nXiIUyFvrv3K

Score

8^/10

discovery evasion persistence trojan upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\utlio = "C:\\Windows\\SysWOW64\\fdBth4.exe"	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe

Executes dropped EXE 1 IoCs

pid	Process
580	fdBth4.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1896-55-0x00000000004A0000-0x0000000000546000-memory.dmp	upx
behavioral1/memory/1896-58-0x00000000004A0000-0x0000000000546000-memory.dmp	upx
behavioral1/memory/1896-59-0x00000000004A0000-0x0000000000546000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe

Deletes itself 1 IoCs

pid	Process
1700	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fdBth4.exe	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
File opened for modification	C:\Windows\SysWOW64\fdBth4.exe	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe
580	fdBth4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
Token: SeDebugPrivilege	580	fdBth4.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 580	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	27
PID 1896 wrote to memory of 580	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	27
PID 1896 wrote to memory of 580	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	27
PID 1896 wrote to memory of 580	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	27
PID 1896 wrote to memory of 1700	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	29
PID 1896 wrote to memory of 1700	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	29
PID 1896 wrote to memory of 1700	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	29
PID 1896 wrote to memory of 1700	1896	5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe	29

C:\Users\Admin\AppData\Local\Temp\5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
"C:\Users\Admin\AppData\Local\Temp\5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe"
1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\fdBth4.exe
  C:\Windows\SysWOW64\fdBth4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:580
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Users\Admin\AppData\Local\Temp\~unins4095.bat "C:\Users\Admin\AppData\Local\Temp\5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe"
  2⤵
  - Deletes itself
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~unins4095.bat

Filesize
49B

MD5
9e0a2f5ab30517809b95a1ff1dd98c53

SHA1
5c1eefdf10e67d1e9216e2e3f5e92352d583c9ce

SHA256
97ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32

SHA512
e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42

Download Submit
C:\Windows\SysWOW64\fdBth4.exe

Filesize
170KB

MD5
b637001a19eade129b0c685fc8470721

SHA1
201b3c3ce85e10ab229465baf241bd810d68ca18

SHA256
631fc8bb18f6fb0317fd8d79e664f63507cf8c39de6615dd96da6e2e06b24da4

SHA512
8f1bc10895c0fc375425468d5ed068b238ac2a8112c9e8995445f6e1e74b4633b3e206339098fe8f0fd55eeb5ebec5bf686bf27dbf18eaa52a37aeae3537b8e2

Download Submit
C:\Windows\SysWOW64\fdBth4.exe

Filesize
170KB

MD5
b637001a19eade129b0c685fc8470721

SHA1
201b3c3ce85e10ab229465baf241bd810d68ca18

SHA256
631fc8bb18f6fb0317fd8d79e664f63507cf8c39de6615dd96da6e2e06b24da4

SHA512
8f1bc10895c0fc375425468d5ed068b238ac2a8112c9e8995445f6e1e74b4633b3e206339098fe8f0fd55eeb5ebec5bf686bf27dbf18eaa52a37aeae3537b8e2

Download Submit
\Windows\SysWOW64\fdBth4.exe

Filesize
170KB

MD5
b637001a19eade129b0c685fc8470721

SHA1
201b3c3ce85e10ab229465baf241bd810d68ca18

SHA256
631fc8bb18f6fb0317fd8d79e664f63507cf8c39de6615dd96da6e2e06b24da4

SHA512
8f1bc10895c0fc375425468d5ed068b238ac2a8112c9e8995445f6e1e74b4633b3e206339098fe8f0fd55eeb5ebec5bf686bf27dbf18eaa52a37aeae3537b8e2

Download Submit
memory/580-72-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/580-70-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download
memory/1896-58-0x00000000004A0000-0x0000000000546000-memory.dmp

Filesize
664KB

Download
memory/1896-62-0x00000000004A1000-0x0000000000503000-memory.dmp

Filesize
392KB

Download
memory/1896-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1896-60-0x0000000000310000-0x0000000000355000-memory.dmp

Filesize
276KB

Download
memory/1896-55-0x00000000004A0000-0x0000000000546000-memory.dmp

Filesize
664KB

Download
memory/1896-61-0x0000000000503000-0x0000000000545000-memory.dmp

Filesize
264KB

Download
memory/1896-71-0x00000000004A1000-0x0000000000503000-memory.dmp

Filesize
392KB

Download
memory/1896-59-0x00000000004A0000-0x0000000000546000-memory.dmp

Filesize
664KB

Download
memory/1896-73-0x00000000004A1000-0x0000000000503000-memory.dmp

Filesize
392KB

Download