2a3c5075363be6ad673b7c6daca4acfbf14c537e3951b784f8f24ebc39352cb0

Analysis

max time kernel
203s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faturanet.exe
Size

212KB
MD5

4f964a479250bc6307c448323eba3dda
SHA1

52c5950806b0e2126caec6c58aba7d7ec3e4ea4f
SHA256

f90a15ae0725ee8d3b2f1a6d840370ef0c7b463537688f02250c5a53dbcf4479
SHA512

13491dafe9e92dc0e60f39eaf23b020eb8f1c3aa7ac3450aafa07db2f50e89b74361e36b06a9335ee7502198233640d446251fc1a5c4bc5802f68739468bc0ac
SSDEEP

6144:2QBgEWmvH1nmXHJF3zB2ivUDec7BEOmZMi:EERvwZNZvCec7LuMi

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/1452-132-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral4/memory/1452-133-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral4/memory/1452-134-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

faturanet.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	faturanet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunDLL32 = "C:\\Users\\Admin\\Desktop\\socaagdts\\socaagdts.exe"	faturanet.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

808 1452 WerFault.exe faturanet.exe

pid	pid_target	process	target process
808	1452	WerFault.exe	faturanet.exe

C:\Users\Admin\AppData\Local\Temp\faturanet.exe
"C:\Users\Admin\AppData\Local\Temp\faturanet.exe"
1⤵
- Adds Run key to start application
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 896
  2⤵
  - Program crash
  PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1452 -ip 1452
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1452-132-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1452-133-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/1452-134-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download