4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed

Analysis

max time kernel
161s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.6MB
Sample221127-t6jndacb95
SHA256 4fb85146079a6ad27e94e913e2302d6a47f8f5409f55f174aecdd8c99ab372ed
MD5 10c4eb50adca0b5e5c38ae0fdfa422fc
SHA1 204fa092bd55f6c999733807115dbc5817fd2fa8
SHA512 552fd54a83ba2bb2b64d25890aa1336ca397669fd3dbdf8bc64a3edc2bb4e71aa4207b54b09e3ca050acaf2d4cb4b56740b22152abd047e1627874a8ec968636
SSDEEP 49152:a/7FssC0KqUwzp+Z9vAaE5FKY/t764UzLUA/AOiyjrbsnnzvSn9rsPN/+9rjNvnT:K5sr4V+Zp4UzJ/TknzZ69XOY
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1436	AlLpDBzutF.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1744	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	38	Go-http-client/1.1

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 5012	4320	file.exe	80
PID 4320 wrote to memory of 5012	4320	file.exe	80
PID 4320 wrote to memory of 5012	4320	file.exe	80
PID 5012 wrote to memory of 1744	5012	cmd.exe	82
PID 5012 wrote to memory of 1744	5012	cmd.exe	82
PID 5012 wrote to memory of 1744	5012	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn xGCKbNsXzq /tr C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Creates scheduled task(s)
    PID:1744

C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
1⤵
- Executes dropped EXE
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AlLpDBzutF.exe

Path C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
Size 643.8MB
SHA256 5b7a45d529b53eba5aef4a619bb3439ea447da949e53a80407c3720076b53eac
MD5 b35859689e2c077cc07d2169a7534732
SHA1 f3ac91c136b9b10f312defcb6c2c004d4b6be325
SHA512 3b56ab4d5f0543e1b6635bf05b6e0fd44bd41e1d1d6dde33d13836471f6cc587b29486a13fe8544a25b8c13ed288e8b0db94bd8c504ed74abb2aecdb0b39116d
SSDEEP 12582912:J/U7CyOXNi2ShxA59UZlExZUqIVvjt3zGSXUIiQFQK+PbgJb:J/CCrNoOfUoZUqIZRjdXUInQ9EJb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlLpDBzutF.exe

Path C:\Users\Admin\AppData\Roaming\xGCKbNsXzq\AlLpDBzutF.exe
Size 632.5MB
SHA256 b50a2a29ce5211077c076f3c7eb070697f64072193b5a1c6ba1c47068b78e6e7
MD5 6f4446eed56704a702526e20bb34122a
SHA1 6ebd6af6f1372a17fd260f240aad1ea02161893f
SHA512 bb7c67a682002641b126362fe576a448fb57a5f4ea66101b7b57d96a69c25c8e1c7fe8b53f3fcef42a549ebf79481610d96d99371e79cea7f818495da58cfc7b
SSDEEP 12582912:J/U7CyOXNi2ShxA59UZlExZUqIVvjt3zGSXUIiQFQK+Pbgn:J/CCrNoOfUoZUqIZRjdXUInQ9En
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads