d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7

Analysis

max time kernel
150s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-02-2023 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe
Size

2.5MB
MD5

b1a837d1724ad87963475e27d9550dee
SHA1

108baa2231c4d5696f8764e931a8defffa5f5a56
SHA256

d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7
SHA512

ad177c1aa7a9adcd13bce31e0c19899fbde46c4888c5fd94ebbff931c6a809b94d434190f485ffad6969ee5c949c6f541a07197a597d2235f06aa0b985bdbe3d
SSDEEP

49152:bwTKIf5X0xpzfaQCUQLxvD0TQ9DnvwZ+kgxadJCJKJd8h8+vTROVgMC/Z2czqJNW:baKMOpzfahLMCDvwIQdJCQJyh8yVO2M8

Score

7^/10

aspackv2 upx

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe	aspack_v212_v242

Executes dropped EXE 2 IoCs

Processes:

Aria2_Pro.exearia2cpan.exe

pid process

932 Aria2_Pro.exe
1200 aria2cpan.exe

pid	process
932	Aria2_Pro.exe
1200	aria2cpan.exe

Loads dropped DLL 5 IoCs

Processes:

d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exeAria2_Pro.exe

pid	process
1016	d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe
1016	d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe
932	Aria2_Pro.exe
932	Aria2_Pro.exe
1764

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe	upx
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe	upx
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe	upx
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe	upx
behavioral1/memory/1200-73-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/memory/1200-75-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

Aria2_Pro.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main Aria2_Pro.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Aria2_Pro.exe

pid process

932 Aria2_Pro.exe
932 Aria2_Pro.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Aria2_Pro.exe

pid process

932 Aria2_Pro.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Aria2_Pro.exe

pid process

932 Aria2_Pro.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Aria2_Pro.exe

pid process

932 Aria2_Pro.exe
932 Aria2_Pro.exe
932 Aria2_Pro.exe
932 Aria2_Pro.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	Aria2_Pro.exe

pid	process
932	Aria2_Pro.exe
932	Aria2_Pro.exe

pid	process
932	Aria2_Pro.exe

pid	process
932	Aria2_Pro.exe

pid	process
932	Aria2_Pro.exe
932	Aria2_Pro.exe
932	Aria2_Pro.exe
932	Aria2_Pro.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exeAria2_Pro.exe

description	pid	process	target process
PID 1016 wrote to memory of 932	1016	d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe	Aria2_Pro.exe
PID 1016 wrote to memory of 932	1016	d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe	Aria2_Pro.exe
PID 1016 wrote to memory of 932	1016	d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe	Aria2_Pro.exe
PID 1016 wrote to memory of 932	1016	d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe	Aria2_Pro.exe
PID 932 wrote to memory of 1200	932	Aria2_Pro.exe	aria2cpan.exe
PID 932 wrote to memory of 1200	932	Aria2_Pro.exe	aria2cpan.exe
PID 932 wrote to memory of 1200	932	Aria2_Pro.exe	aria2cpan.exe
PID 932 wrote to memory of 1200	932	Aria2_Pro.exe	aria2cpan.exe

C:\Users\Admin\AppData\Local\Temp\d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe
"C:\Users\Admin\AppData\Local\Temp\d0fb1326496b401393d08b9e39e0238e5651418d7e5c6f1f5fc22824bec35ee7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe
"C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932

C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe
"C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe" C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe --conf-path=aria2.conf
3⤵
- Executes dropped EXE
PID:1200

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe
Filesize
2.4MB

MD5
5df604e190acdc0f2cc2f0752107c362

SHA1
d72d146a58166af31e7f5283ed69b53b2bc074d8

SHA256
679bd7a07636f6ce48510cc08438ff2de915e49a61b2aa1f05671f5fbe725269

SHA512
ba486e778bf407a3a92f552bcdc0dc511a906d8a70837f086ebc2b0a511acdb7458d33a5728a4dba932b37c338140770c702c671b979e03d4cbeeec75214339c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe
Filesize
2.4MB

MD5
5df604e190acdc0f2cc2f0752107c362

SHA1
d72d146a58166af31e7f5283ed69b53b2bc074d8

SHA256
679bd7a07636f6ce48510cc08438ff2de915e49a61b2aa1f05671f5fbe725269

SHA512
ba486e778bf407a3a92f552bcdc0dc511a906d8a70837f086ebc2b0a511acdb7458d33a5728a4dba932b37c338140770c702c671b979e03d4cbeeec75214339c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2.conf
Filesize
925B

MD5
c055eb20d59e2e21e91c69b5fe09946f

SHA1
7027caad1a3b691452ae1338ca8b1aa4a3cf0697

SHA256
c2935494ead028312ce7f6086f53584ca41c7fbef3f9557611ae606f6726f9a3

SHA512
499364021720e91dc5e2df66abb22c6d218045eed59b12b63c4b113f189bf569b7ee1663d214597bed288113130bef33c937c4fb74b5db84adfe45edc8f54a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2.session
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe
Filesize
1.5MB

MD5
63716bd8a4051a007fc462a28c31a77f

SHA1
df3af34ee9ffdf45a0a2923789ff45f72d6943fe

SHA256
c95a2daaa032ca4cf5be6c91b321a8cba37228f5762c7f7cb744d1d52186589f

SHA512
5c33f0f66adeb0f8a9b3bb248854bdb8f8b6273847df14665514f8ebb4c39bbb43205e85c49309f007e2cdfd97e50008e946376195d126a34b0b3db47e2ef6c3

Download Submit
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe
Filesize
2.4MB

MD5
5df604e190acdc0f2cc2f0752107c362

SHA1
d72d146a58166af31e7f5283ed69b53b2bc074d8

SHA256
679bd7a07636f6ce48510cc08438ff2de915e49a61b2aa1f05671f5fbe725269

SHA512
ba486e778bf407a3a92f552bcdc0dc511a906d8a70837f086ebc2b0a511acdb7458d33a5728a4dba932b37c338140770c702c671b979e03d4cbeeec75214339c

Download Submit
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\Aria2_Pro.exe
Filesize
2.4MB

MD5
5df604e190acdc0f2cc2f0752107c362

SHA1
d72d146a58166af31e7f5283ed69b53b2bc074d8

SHA256
679bd7a07636f6ce48510cc08438ff2de915e49a61b2aa1f05671f5fbe725269

SHA512
ba486e778bf407a3a92f552bcdc0dc511a906d8a70837f086ebc2b0a511acdb7458d33a5728a4dba932b37c338140770c702c671b979e03d4cbeeec75214339c

Download Submit
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe
Filesize
1.5MB

MD5
63716bd8a4051a007fc462a28c31a77f

SHA1
df3af34ee9ffdf45a0a2923789ff45f72d6943fe

SHA256
c95a2daaa032ca4cf5be6c91b321a8cba37228f5762c7f7cb744d1d52186589f

SHA512
5c33f0f66adeb0f8a9b3bb248854bdb8f8b6273847df14665514f8ebb4c39bbb43205e85c49309f007e2cdfd97e50008e946376195d126a34b0b3db47e2ef6c3

Download Submit
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe
Filesize
1.5MB

MD5
63716bd8a4051a007fc462a28c31a77f

SHA1
df3af34ee9ffdf45a0a2923789ff45f72d6943fe

SHA256
c95a2daaa032ca4cf5be6c91b321a8cba37228f5762c7f7cb744d1d52186589f

SHA512
5c33f0f66adeb0f8a9b3bb248854bdb8f8b6273847df14665514f8ebb4c39bbb43205e85c49309f007e2cdfd97e50008e946376195d126a34b0b3db47e2ef6c3

Download Submit
\Users\Admin\AppData\Local\Temp\MC×Ô¶¯ÏÂÔØ\aria2cpan.exe
Filesize
1.5MB

MD5
63716bd8a4051a007fc462a28c31a77f

SHA1
df3af34ee9ffdf45a0a2923789ff45f72d6943fe

SHA256
c95a2daaa032ca4cf5be6c91b321a8cba37228f5762c7f7cb744d1d52186589f

SHA512
5c33f0f66adeb0f8a9b3bb248854bdb8f8b6273847df14665514f8ebb4c39bbb43205e85c49309f007e2cdfd97e50008e946376195d126a34b0b3db47e2ef6c3

Download Submit
memory/932-60-0x0000000000400000-0x0000000000753000-memory.dmp

Filesize
3.3MB

Download
memory/932-62-0x0000000000400000-0x0000000000753000-memory.dmp

Filesize
3.3MB

Download
memory/932-61-0x0000000000400000-0x0000000000753000-memory.dmp

Filesize
3.3MB

Download
memory/932-64-0x0000000000400000-0x0000000000753000-memory.dmp

Filesize
3.3MB

Download
memory/932-72-0x0000000005260000-0x000000000574F000-memory.dmp

Filesize
4.9MB

Download
memory/932-57-0x0000000000000000-mapping.dmp

Download
memory/932-77-0x0000000000400000-0x0000000000753000-memory.dmp

Filesize
3.3MB

Download
memory/1016-63-0x0000000003230000-0x0000000003583000-memory.dmp

Filesize
3.3MB

Download
memory/1016-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1016-76-0x0000000003230000-0x0000000003583000-memory.dmp

Filesize
3.3MB

Download
memory/1200-68-0x0000000000000000-mapping.dmp

Download
memory/1200-73-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1200-75-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download