9835cdcdeeff23e6dd9f5a76a6071d734a83dc66e7411ddf3c9ac803abd1a4af

Analysis

max time kernel
33s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/04/2023, 16:11

Target

bob_leponge.exe
Size

8.3MB
MD5

330472b720577832869cb242c0dc1731
SHA1

bfad071c3d377310b9d21c9e98b7caa0be619a1d
SHA256

9835cdcdeeff23e6dd9f5a76a6071d734a83dc66e7411ddf3c9ac803abd1a4af
SHA512

c7bc5cb287651a56f1aef252880bce77178b83087fd7fbb7d1bc4d8eea61928719c87e844dff48be4698cb5d8f94ae3273368fb68a58f1a222a03c58e990ff40
SSDEEP

196608:dXgafMj+16B6yYnlPzf+JiT4n3XWK2MvnwE9VyUyFfuF5nd:eafiBRYnlPSF3VVvnwjBuP

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
268	bob_leponge.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x0008000000012311-81.dat	upx
behavioral1/files/0x0008000000012311-82.dat	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1896	AUDIODG.EXE
Token: 33	1896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1896	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 268	1984	bob_leponge.exe	27
PID 1984 wrote to memory of 268	1984	bob_leponge.exe	27
PID 1984 wrote to memory of 268	1984	bob_leponge.exe	27

C:\Users\Admin\AppData\Local\Temp\bob_leponge.exe
"C:\Users\Admin\AppData\Local\Temp\bob_leponge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\bob_leponge.exe
  "C:\Users\Admin\AppData\Local\Temp\bob_leponge.exe"
  2⤵
  - Loads dropped DLL
  PID:268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Users\Admin\AppData\Local\Temp\_MEI19842\python311.dll

Filesize
1.6MB

MD5
53b1a9474ddc3a31adf72011dc8da780

SHA1
36f476d318acca6a12d3625b02cb14ab19534db7

SHA256
357e545f47b605682328566a8df692dc22e4ea2ab37686788c3416b3813addc7

SHA512
290c070eaf324476bfda676fc547ee42479a239b11192b654604862d53de1f1752a2f1b212dc15b3a22787a6469d6ec22ced98b7bb7d5f7c618602bbd12b7881

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI19842\python311.dll

Filesize
1.6MB

MD5
53b1a9474ddc3a31adf72011dc8da780

SHA1
36f476d318acca6a12d3625b02cb14ab19534db7

SHA256
357e545f47b605682328566a8df692dc22e4ea2ab37686788c3416b3813addc7

SHA512
290c070eaf324476bfda676fc547ee42479a239b11192b654604862d53de1f1752a2f1b212dc15b3a22787a6469d6ec22ced98b7bb7d5f7c618602bbd12b7881

Download Submit
memory/268-83-0x000007FEF61A0000-0x000007FEF678A000-memory.dmp

Filesize
5.9MB

Download