eedeb7539b2f680304e81c08f27372bc5459b8e406872f8ea939065e466f0774

Resubmissions

01-12-2022 16:35

221201-t345xagb67 10

23-11-2022 19:33

221123-x9kavshd23 10

Analysis

max time kernel
112s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe
Size

17.6MB
MD5

8c2a390aa7833720b374a720a6d06e4d
SHA1

188ec1a33bfd028333bcc3f6e96d2dbbdf01367f
SHA256

eedeb7539b2f680304e81c08f27372bc5459b8e406872f8ea939065e466f0774
SHA512

ac9bac95c37944ef7bb053126d5e5ba67c74562434b7bd4cb6f4c54e1d1cef8204990d670920f48af1cf26fb59ac422c0ccfe0075940cfe9c45e995897b86a07
SSDEEP

98304:BMSVESq5M3ClAD3sXHLQTyaQRO+YwWcRImg0cHQwb4CsB/wpDm7qCOPXwRalZLCt:2SSSP7sNavN7mg0mlb3DDdDP0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

UIServices.exe

pid process

4732 UIServices.exe
Loads dropped DLL 1 IoCs

Processes:

UIServices.exe

pid process

4732 UIServices.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4852 4732 WerFault.exe UIServices.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

UIServices.exe

pid process

4732 UIServices.exe
4732 UIServices.exe

pid	process
4732	UIServices.exe

pid	process
4732	UIServices.exe

pid	pid_target	process	target process
4852	4732	WerFault.exe	UIServices.exe

pid	process
4732	UIServices.exe
4732	UIServices.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.execmd.exe

description	pid	process	target process
PID 4836 wrote to memory of 1256	4836	SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe	cmd.exe
PID 4836 wrote to memory of 1256	4836	SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe	cmd.exe
PID 4836 wrote to memory of 1256	4836	SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe	cmd.exe
PID 1256 wrote to memory of 4732	1256	cmd.exe	UIServices.exe
PID 1256 wrote to memory of 4732	1256	cmd.exe	UIServices.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\AppData\Local\Temp\UIServices.exe
C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4732

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4732 -s 968
4⤵
- Program crash
PID:4852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 396 -p 4732 -ip 4732
1⤵
PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UIServices.exe
Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
C:\Users\Admin\AppData\Local\Temp\UIServices.exe
Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
memory/1256-135-0x0000000000000000-mapping.dmp

Download
memory/4732-136-0x0000000000000000-mapping.dmp

Download