c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c

Analysis

max time kernel
135s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe
Size

252KB
MD5

10de81d30c7ea4a521ded7cd51da1d65
SHA1

52acd820ee1f13b9f4ed19b9784676f95a640db6
SHA256

c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c
SHA512

54f2838300bef9192c39634be5c75f4c849ae4649c6be064944f6a619658a6e93c4d7b7810d9482d43d69fc22b266d09189f8deb84cfb201bcb4da8f45b91869
SSDEEP

6144:okcjWCXVIFD73YqJd1RoSjvbdmqw7+H5:Dc3XVI58qJjvjvbYq5

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4316	lmcl.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1772-132-0x0000000000400000-0x00000000004A4000-memory.dmp	upx
behavioral2/files/0x0003000000000727-134.dat	upx
behavioral2/files/0x0003000000000727-135.dat	upx
behavioral2/memory/4316-136-0x0000000000400000-0x00000000004A4000-memory.dmp	upx
behavioral2/memory/1772-137-0x0000000000400000-0x00000000004A4000-memory.dmp	upx
behavioral2/memory/4316-138-0x0000000000400000-0x00000000004A4000-memory.dmp	upx
behavioral2/memory/1772-140-0x0000000000400000-0x00000000004A4000-memory.dmp	upx
behavioral2/memory/4316-142-0x0000000000400000-0x00000000004A4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	lmcl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lmcl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lmcl.exe"	lmcl.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe
1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4316	1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe	84
PID 1772 wrote to memory of 4316	1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe	84
PID 1772 wrote to memory of 4316	1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe	84
PID 1772 wrote to memory of 1728	1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe	92
PID 1772 wrote to memory of 1728	1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe	92
PID 1772 wrote to memory of 1728	1772	c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe	92

C:\Users\Admin\AppData\Local\Temp\c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe
"C:\Users\Admin\AppData\Local\Temp\c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\lmcl.exe
  C:\Users\Admin\AppData\Local\Temp\lmcl.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\deleteself.bat
  2⤵
  PID:1728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\deleteself.bat

Filesize
296B

MD5
e529d11ce94959145416aa7c3e618c93

SHA1
6178c2f1de1e9eddeeb8392027274d398f655fe2

SHA256
406a705efee8fe0eda759142023f870972cc8345eb01752d9cfb88dc227fb021

SHA512
4ea803e3f59f683a3f38e145192c8c110366431ac0b863595abc002ef516676d9253f3f844a29709110f107701d874a655eb42928fc4ee46e24f67bd027406df

Download Submit
C:\Users\Admin\AppData\Local\Temp\lmcl.exe

Filesize
252KB

MD5
10de81d30c7ea4a521ded7cd51da1d65

SHA1
52acd820ee1f13b9f4ed19b9784676f95a640db6

SHA256
c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c

SHA512
54f2838300bef9192c39634be5c75f4c849ae4649c6be064944f6a619658a6e93c4d7b7810d9482d43d69fc22b266d09189f8deb84cfb201bcb4da8f45b91869

Download Submit
C:\Users\Admin\AppData\Local\Temp\lmcl.exe

Filesize
252KB

MD5
10de81d30c7ea4a521ded7cd51da1d65

SHA1
52acd820ee1f13b9f4ed19b9784676f95a640db6

SHA256
c822e5a2384f768fbda3092cd7eb525e09e09ad585666ef2ee658da26f490a1c

SHA512
54f2838300bef9192c39634be5c75f4c849ae4649c6be064944f6a619658a6e93c4d7b7810d9482d43d69fc22b266d09189f8deb84cfb201bcb4da8f45b91869

Download Submit
memory/1772-132-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1772-137-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/1772-140-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4316-136-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4316-138-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/4316-142-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download