Analysis

  • max time kernel
    284s
  • max time network
    312s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 09:39

General

  • Target

    75b2cae489415519c840721bec4d921140346e272c1db6f4eddb01584d17ca1b.exe

  • Size

    385KB

  • MD5

    e1d8e80851a24e1b3f4a9a6d6157eadb

  • SHA1

    36e3fb9ffb8969dd3383b165f1eae59452377d78

  • SHA256

    75b2cae489415519c840721bec4d921140346e272c1db6f4eddb01584d17ca1b

  • SHA512

    639008f7c9ceba4b0b2808c5f8d07971d6c3d9c41c2b468d96879a6f419fc16a12150123976f50e2917cdfb9e47eb893cb416d961053e36e10b707c6be327a61

  • SSDEEP

    6144:lMjTSMUhdc4WIMQeCujuQkFRI+++192NcYDZTx4rstZvvObI5IOXup3NZDL0Cz:G9qMoTRc+T2NDZTOi0ESdL0g

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 18 IoCs
  • Drops file in Windows directory 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75b2cae489415519c840721bec4d921140346e272c1db6f4eddb01584d17ca1b.exe
    "C:\Users\Admin\AppData\Local\Temp\75b2cae489415519c840721bec4d921140346e272c1db6f4eddb01584d17ca1b.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
      2⤵
        PID:4184
    • C:\Windows\G_Server.exe
      C:\Windows\G_Server.exe
      1⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:3836
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank
        2⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:17410 /prefetch:2
          3⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:3556

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\G_Server.exe

      Filesize

      385KB

      MD5

      e1d8e80851a24e1b3f4a9a6d6157eadb

      SHA1

      36e3fb9ffb8969dd3383b165f1eae59452377d78

      SHA256

      75b2cae489415519c840721bec4d921140346e272c1db6f4eddb01584d17ca1b

      SHA512

      639008f7c9ceba4b0b2808c5f8d07971d6c3d9c41c2b468d96879a6f419fc16a12150123976f50e2917cdfb9e47eb893cb416d961053e36e10b707c6be327a61

    • C:\Windows\G_Server.exe

      Filesize

      385KB

      MD5

      e1d8e80851a24e1b3f4a9a6d6157eadb

      SHA1

      36e3fb9ffb8969dd3383b165f1eae59452377d78

      SHA256

      75b2cae489415519c840721bec4d921140346e272c1db6f4eddb01584d17ca1b

      SHA512

      639008f7c9ceba4b0b2808c5f8d07971d6c3d9c41c2b468d96879a6f419fc16a12150123976f50e2917cdfb9e47eb893cb416d961053e36e10b707c6be327a61

    • C:\Windows\uninstal.bat

      Filesize

      254B

      MD5

      df7b7fe9bde6c2a2c9d786d10f51a1e7

      SHA1

      43da02acf62b6c13352175aa9c12b7746d73b0f5

      SHA256

      04e97b45d32b47773f57c83c928991eda477577bf0823543e7fca8846e8c3e3e

      SHA512

      2330d30c230f99211781bf2b4aac7ce2d1e9589d70224a070cef8288bf0ce56a46e934a4ed21e740ee5ee648fbe384374abbe37197f256fa10a902ea3597b3f7

    • memory/3608-132-0x0000000013140000-0x000000001322D000-memory.dmp

      Filesize

      948KB

    • memory/3608-137-0x0000000013140000-0x000000001322D000-memory.dmp

      Filesize

      948KB

    • memory/3836-135-0x0000000013140000-0x000000001322D000-memory.dmp

      Filesize

      948KB

    • memory/3836-138-0x0000000013140000-0x000000001322D000-memory.dmp

      Filesize

      948KB