Analysis
-
max time kernel
154s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:52
Static task
static1
Behavioral task
behavioral1
Sample
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe
Resource
win10v2004-20220901-en
General
-
Target
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe
-
Size
299KB
-
MD5
c7df8da8da673768ff7fea2ebdcd8ddf
-
SHA1
56cb2f20a9a1db46720fef4e102881cd741f40e9
-
SHA256
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e
-
SHA512
f345d0f4466bfee449ee04f9c8def9175faf89e184c2d461519998fc8692827540a04190a0c98e676d2d4797a241d12e0dd814bd8438b2af67e39cabc488bf7e
-
SSDEEP
6144:wmaQqrJznERQvOYQ1Dig9RvUb8X3UyH88Hit48YLwkFIelW:LapznEKmLViQvUI0yeqwkF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ucop.exepid process 272 ucop.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1864 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exepid process 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ucop.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ucop = "C:\\Users\\Admin\\AppData\\Roaming\\Xailr\\ucop.exe" ucop.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run ucop.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exedescription pid process target process PID 1728 set thread context of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
ucop.exepid process 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe 272 ucop.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exeucop.exedescription pid process target process PID 1728 wrote to memory of 272 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe ucop.exe PID 1728 wrote to memory of 272 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe ucop.exe PID 1728 wrote to memory of 272 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe ucop.exe PID 1728 wrote to memory of 272 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe ucop.exe PID 272 wrote to memory of 1132 272 ucop.exe taskhost.exe PID 272 wrote to memory of 1132 272 ucop.exe taskhost.exe PID 272 wrote to memory of 1132 272 ucop.exe taskhost.exe PID 272 wrote to memory of 1132 272 ucop.exe taskhost.exe PID 272 wrote to memory of 1132 272 ucop.exe taskhost.exe PID 272 wrote to memory of 1172 272 ucop.exe Dwm.exe PID 272 wrote to memory of 1172 272 ucop.exe Dwm.exe PID 272 wrote to memory of 1172 272 ucop.exe Dwm.exe PID 272 wrote to memory of 1172 272 ucop.exe Dwm.exe PID 272 wrote to memory of 1172 272 ucop.exe Dwm.exe PID 272 wrote to memory of 1204 272 ucop.exe Explorer.EXE PID 272 wrote to memory of 1204 272 ucop.exe Explorer.EXE PID 272 wrote to memory of 1204 272 ucop.exe Explorer.EXE PID 272 wrote to memory of 1204 272 ucop.exe Explorer.EXE PID 272 wrote to memory of 1204 272 ucop.exe Explorer.EXE PID 272 wrote to memory of 1728 272 ucop.exe e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe PID 272 wrote to memory of 1728 272 ucop.exe e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe PID 272 wrote to memory of 1728 272 ucop.exe e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe PID 272 wrote to memory of 1728 272 ucop.exe e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe PID 272 wrote to memory of 1728 272 ucop.exe e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe PID 1728 wrote to memory of 1864 1728 e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe"C:\Users\Admin\AppData\Local\Temp\e346dacb5096920ca4953c933a94b1cbdfd1a2bb0450ef82191dccf8f71cf43e.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Xailr\ucop.exe"C:\Users\Admin\AppData\Roaming\Xailr\ucop.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\TOI367A.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TOI367A.batFilesize
303B
MD54621f57bbb1fb87d6ac6a06a2776c3d2
SHA1c23325d008e8652c8324a61d3d74620d64ed4b56
SHA256dbd47b19fd0217b1b0865827d70233b18d56f68a6343006d3b8c65905cf690ef
SHA5127ddcddaa5961af6ac0f1a9400f2462494fd233e81e04594f0f10ae1017c52483faf5429a33ce6b28ba89ef5d627a9aea16a30e16edce26cb4c87ef136135ef6b
-
C:\Users\Admin\AppData\Roaming\Xailr\ucop.exeFilesize
299KB
MD5a8533817390a66f0a546dedba822cd89
SHA15d2743e80a8d90c464ba718518f3f25891c90acc
SHA256c31ecb33654ef454c90839e91c78737d41041ca85481eb996d2252f531e435b7
SHA512b6190b68c8d8be5790f047e6a07c2cd1d3dfd51009cf16b9a5fbeaf416c2910795031b279c7213a2988024bb69f7951a1b4199dcccadc21ef1eb5c0d0b4b68cf
-
C:\Users\Admin\AppData\Roaming\Xailr\ucop.exeFilesize
299KB
MD5a8533817390a66f0a546dedba822cd89
SHA15d2743e80a8d90c464ba718518f3f25891c90acc
SHA256c31ecb33654ef454c90839e91c78737d41041ca85481eb996d2252f531e435b7
SHA512b6190b68c8d8be5790f047e6a07c2cd1d3dfd51009cf16b9a5fbeaf416c2910795031b279c7213a2988024bb69f7951a1b4199dcccadc21ef1eb5c0d0b4b68cf
-
\Users\Admin\AppData\Roaming\Xailr\ucop.exeFilesize
299KB
MD5a8533817390a66f0a546dedba822cd89
SHA15d2743e80a8d90c464ba718518f3f25891c90acc
SHA256c31ecb33654ef454c90839e91c78737d41041ca85481eb996d2252f531e435b7
SHA512b6190b68c8d8be5790f047e6a07c2cd1d3dfd51009cf16b9a5fbeaf416c2910795031b279c7213a2988024bb69f7951a1b4199dcccadc21ef1eb5c0d0b4b68cf
-
\Users\Admin\AppData\Roaming\Xailr\ucop.exeFilesize
299KB
MD5a8533817390a66f0a546dedba822cd89
SHA15d2743e80a8d90c464ba718518f3f25891c90acc
SHA256c31ecb33654ef454c90839e91c78737d41041ca85481eb996d2252f531e435b7
SHA512b6190b68c8d8be5790f047e6a07c2cd1d3dfd51009cf16b9a5fbeaf416c2910795031b279c7213a2988024bb69f7951a1b4199dcccadc21ef1eb5c0d0b4b68cf
-
memory/272-63-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/272-59-0x0000000000000000-mapping.dmp
-
memory/1132-70-0x0000000001C80000-0x0000000001CC8000-memory.dmpFilesize
288KB
-
memory/1132-65-0x0000000001C80000-0x0000000001CC8000-memory.dmpFilesize
288KB
-
memory/1132-69-0x0000000001C80000-0x0000000001CC8000-memory.dmpFilesize
288KB
-
memory/1132-68-0x0000000001C80000-0x0000000001CC8000-memory.dmpFilesize
288KB
-
memory/1132-67-0x0000000001C80000-0x0000000001CC8000-memory.dmpFilesize
288KB
-
memory/1172-73-0x00000000019F0000-0x0000000001A38000-memory.dmpFilesize
288KB
-
memory/1172-74-0x00000000019F0000-0x0000000001A38000-memory.dmpFilesize
288KB
-
memory/1172-75-0x00000000019F0000-0x0000000001A38000-memory.dmpFilesize
288KB
-
memory/1172-76-0x00000000019F0000-0x0000000001A38000-memory.dmpFilesize
288KB
-
memory/1204-82-0x0000000002A80000-0x0000000002AC8000-memory.dmpFilesize
288KB
-
memory/1204-81-0x0000000002A80000-0x0000000002AC8000-memory.dmpFilesize
288KB
-
memory/1204-79-0x0000000002A80000-0x0000000002AC8000-memory.dmpFilesize
288KB
-
memory/1204-80-0x0000000002A80000-0x0000000002AC8000-memory.dmpFilesize
288KB
-
memory/1728-85-0x0000000000570000-0x00000000005B8000-memory.dmpFilesize
288KB
-
memory/1728-90-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1728-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/1728-86-0x0000000000570000-0x00000000005B8000-memory.dmpFilesize
288KB
-
memory/1728-87-0x0000000000570000-0x00000000005B8000-memory.dmpFilesize
288KB
-
memory/1728-88-0x0000000000570000-0x00000000005B8000-memory.dmpFilesize
288KB
-
memory/1728-89-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1728-103-0x0000000000570000-0x00000000005B8000-memory.dmpFilesize
288KB
-
memory/1728-91-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1728-92-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1728-93-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1728-94-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1728-55-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1728-56-0x0000000000401000-0x0000000000441000-memory.dmpFilesize
256KB
-
memory/1864-99-0x0000000000050000-0x0000000000098000-memory.dmpFilesize
288KB
-
memory/1864-100-0x0000000000050000-0x0000000000098000-memory.dmpFilesize
288KB
-
memory/1864-102-0x000000000005D7CE-mapping.dmp
-
memory/1864-101-0x0000000000050000-0x0000000000098000-memory.dmpFilesize
288KB
-
memory/1864-105-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-106-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-107-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-108-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-109-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-111-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-110-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1864-112-0x0000000000050000-0x0000000000098000-memory.dmpFilesize
288KB
-
memory/1864-97-0x0000000000050000-0x0000000000098000-memory.dmpFilesize
288KB