f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe
Size

631KB
MD5

4358bb63469e9e205ef72aba86120e40
SHA1

7f11f731388196803b361af76d507d8139024d2d
SHA256

f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e
SHA512

1925a37d6ef8964e2a00d5cee397255340b1e31ed69c904e6bc29f80887febe94fef43c9c7d25a20cad0a823a479628c7b8e59ad6e955e9e3cf7eb7fe6c8526b
SSDEEP

12288:Ak86ojENhJ9KCJnxnm/HF3Z4mxx+nUqGGGkYThd5UcOCk:bVojENscBm/HQmXaUVGGk6PrOh

Score

8^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\smlogsvc.exe	aspack_v212_v242
C:\Windows\SysWOW64\smlogsvc.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

smlogsvc.exe

pid process

4604 smlogsvc.exe

pid	process
4604	smlogsvc.exe

Drops file in System32 directory 3 IoCs

Processes:

f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exesmlogsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\smlogsvc.exe	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe
File opened for modification	C:\Windows\SysWOW64\smlogsvc.exe	smlogsvc.exe
File created	C:\Windows\SysWOW64\smlogsvc.exe	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe

Drops file in Windows directory 1 IoCs

Processes:

f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe

description ioc process

File created C:\Windows\uninstal.bat f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe

description	ioc	process
File created	C:\Windows\uninstal.bat	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exesmlogsvc.exe

description	pid	process
Token: SeDebugPrivilege	2820	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe
Token: SeDebugPrivilege	4604	smlogsvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe

description	pid	process	target process
PID 2820 wrote to memory of 4956	2820	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe	cmd.exe
PID 2820 wrote to memory of 4956	2820	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe	cmd.exe
PID 2820 wrote to memory of 4956	2820	f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe
"C:\Users\Admin\AppData\Local\Temp\f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
2⤵
PID:4956

C:\Windows\SysWOW64\smlogsvc.exe
C:\Windows\SysWOW64\smlogsvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\smlogsvc.exe

Filesize
631KB

MD5
4358bb63469e9e205ef72aba86120e40

SHA1
7f11f731388196803b361af76d507d8139024d2d

SHA256
f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e

SHA512
1925a37d6ef8964e2a00d5cee397255340b1e31ed69c904e6bc29f80887febe94fef43c9c7d25a20cad0a823a479628c7b8e59ad6e955e9e3cf7eb7fe6c8526b

Download Submit
C:\Windows\SysWOW64\smlogsvc.exe

Filesize
631KB

MD5
4358bb63469e9e205ef72aba86120e40

SHA1
7f11f731388196803b361af76d507d8139024d2d

SHA256
f3d00b85306e0a16238e2a47f09683d7771a3177662231dab2268e77d363ac9e

SHA512
1925a37d6ef8964e2a00d5cee397255340b1e31ed69c904e6bc29f80887febe94fef43c9c7d25a20cad0a823a479628c7b8e59ad6e955e9e3cf7eb7fe6c8526b

Download Submit
C:\Windows\uninstal.bat

Filesize
254B

MD5
6cea32472deba9de9126ab9ad5fec2c5

SHA1
8bab7b8b3f93ca0dc91ddef49ce56a8f976a5f49

SHA256
5fe582ad86eab9de5d152e20617a605149168d33ed3bbc17c4bf7b09820c9047

SHA512
c812a946bf9a68909aa09f8e8b33bb8585d2c33b3cbaf423ae5487c0f881c2183cbfbafb49e278eabf18b22cca91382195ba0e2cc536988c82f13364b5ac32a6

Download Submit
memory/2820-145-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/2820-133-0x0000000000A40000-0x0000000000A94000-memory.dmp

Filesize
336KB

Download
memory/2820-134-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2820-135-0x0000000003380000-0x0000000003480000-memory.dmp

Filesize
1024KB

Download
memory/2820-146-0x0000000000A40000-0x0000000000A94000-memory.dmp

Filesize
336KB

Download
memory/2820-132-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/4604-140-0x0000000002030000-0x0000000002130000-memory.dmp

Filesize
1024KB

Download
memory/4604-142-0x0000000000E80000-0x0000000000ED4000-memory.dmp

Filesize
336KB

Download
memory/4604-143-0x0000000002030000-0x0000000002130000-memory.dmp

Filesize
1024KB

Download
memory/4604-141-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/4604-139-0x0000000000E80000-0x0000000000ED4000-memory.dmp

Filesize
336KB

Download
memory/4604-138-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/4956-144-0x0000000000000000-mapping.dmp

Download