Analysis
- max time kernel
202s - max time network
206s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
27/11/2022, 01:48
General
- Target e5c40bf786c578cd16e28adc6217d6bcf8fb18c9c2d75768ad20743d90d7e81d.exe
- Size 292KB
- Sample221127-b8fqdseh6s
- SHA256 e5c40bf786c578cd16e28adc6217d6bcf8fb18c9c2d75768ad20743d90d7e81d
Malware Config
Signatures
- ASPack v2.12-2.42 26 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 1 IoCs
- Sets DLL path for service in the registry 2 TTPs 14 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Loads dropped DLL 12 IoCs
- Drops file in System32 directory 14 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5c40bf786c578cd16e28adc6217d6bcf8fb18c9c2d75768ad20743d90d7e81d.exe"C:\Users\Admin\AppData\Local\Temp\e5c40bf786c578cd16e28adc6217d6bcf8fb18c9c2d75768ad20743d90d7e81d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\0feb6554.exeC:\0feb6554.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
0feb6554.exe
0feb6554.exe
FastUserSwitchingCompatibility.dll
Irmon.dll
LogonHours.dll
NWCWorkstation.dll
Nla.dll
Ntmssvc.dll
Nwsapagent.dll
PCAudit.dll
SRService.dll
WmdmPmSp.dll
helpsvc.dll
uploadmgr.dll
fastuserswitchingcompatibility.dll
helpsvc.dll
irmon.dll
logonhours.dll
nla.dll
ntmssvc.dll
nwcworkstation.dll
nwsapagent.dll
pcaudit.dll
srservice.dll
uploadmgr.dll
wmdmpmsp.dll
memory/1312-200-0x0000000074820000-0x000000007486E000-memory.dmp
memory/1312-201-0x0000000074820000-0x000000007486E000-memory.dmp
memory/1312-202-0x0000000074820000-0x000000007486E000-memory.dmp
memory/1832-156-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/1832-157-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/1832-155-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/1840-136-0x00000000002A0000-0x00000000002EE000-memory.dmp
memory/1840-140-0x0000000002910000-0x0000000006910000-memory.dmp
memory/1840-146-0x0000000002910000-0x0000000006910000-memory.dmp
memory/1840-137-0x00000000002A0000-0x00000000002EE000-memory.dmp
memory/1840-138-0x00000000002A0000-0x00000000002EE000-memory.dmp
memory/1940-182-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/1940-180-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/1940-181-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2368-192-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2368-193-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2368-191-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2648-187-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2648-185-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2648-186-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/2744-142-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/2744-143-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/2744-144-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/3404-161-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/3404-162-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/3404-160-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/3484-145-0x0000000000400000-0x0000000000460000-memory.dmp
memory/3484-132-0x0000000000400000-0x0000000000460000-memory.dmp
memory/3792-175-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/3792-177-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/3792-176-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/4200-172-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/4200-170-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/4200-171-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/4936-149-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/4936-152-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/4936-151-0x0000000074FD0000-0x000000007501E000-memory.dmp
memory/4980-196-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/4980-197-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/4980-198-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/5084-165-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/5084-166-0x0000000074870000-0x00000000748BE000-memory.dmp
memory/5084-167-0x0000000074870000-0x00000000748BE000-memory.dmp