4e214aada010f0761062335b78a1bbddc879ca3bd696c7021bd3f5e8f5ab5e83

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update_dll.exe
Size

1.6MB
MD5

2ec19478c6e5f4ff9f373b275d1910c5
SHA1

01112e3d156f802059575369d039a92f95bf9025
SHA256

4e214aada010f0761062335b78a1bbddc879ca3bd696c7021bd3f5e8f5ab5e83
SHA512

3ca2eec0dcaaedd548faa363e850855479ba045d68b4be7f70592ddeb3671daa10175b21579861b764440d1cbf02dc98fcc020c217801f71d4150c0699c13b2d
SSDEEP

24576:y8Iog+CuyfdDCvi3c9FSgt4syKh8TVmRCE4kDXY1Ur3TfXK9QG0ILPp6MNvTxvwK:T6uyVex0c49KgVmWeMJXFVrJ3

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
728	p_update.exe
328	p_update.exe

Loads dropped DLL 10 IoCs

pid	Process
1344	update_dll.exe
728	p_update.exe
728	p_update.exe
728	p_update.exe
728	p_update.exe
1344	update_dll.exe
328	p_update.exe
328	p_update.exe
328	p_update.exe
328	p_update.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1344-54-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1344-78-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1344-98-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 728	1344	update_dll.exe	28
PID 1344 wrote to memory of 328	1344	update_dll.exe	29
PID 1344 wrote to memory of 328	1344	update_dll.exe	29
PID 1344 wrote to memory of 328	1344	update_dll.exe	29
PID 1344 wrote to memory of 328	1344	update_dll.exe	29
PID 1344 wrote to memory of 328	1344	update_dll.exe	29
PID 1344 wrote to memory of 328	1344	update_dll.exe	29
PID 1344 wrote to memory of 328	1344	update_dll.exe	29

C:\Users\Admin\AppData\Local\Temp\update_dll.exe
"C:\Users\Admin\AppData\Local\Temp\update_dll.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update_dll.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:728
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\UpdateLog.log

Filesize
156B

MD5
0b4d4ebc00b055307b9561135ff77a0d

SHA1
f713de9492718abbfb3d659a12cd51400943f227

SHA256
edb3b6699328c40ccde1eca8c2ad14120dc9bfc18579fbcc0b6c0a40db384eec

SHA512
323a0781a5d63e42c039a46f66b521617d8e4e7f2fed5db5a513e68c881a4aab9c1fb6cd83aa72442bb8429885cd7598ee0bccc3a549322b324d499ad3b0da2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\UpdateLog.log

Filesize
156B

MD5
0b4d4ebc00b055307b9561135ff77a0d

SHA1
f713de9492718abbfb3d659a12cd51400943f227

SHA256
edb3b6699328c40ccde1eca8c2ad14120dc9bfc18579fbcc0b6c0a40db384eec

SHA512
323a0781a5d63e42c039a46f66b521617d8e4e7f2fed5db5a513e68c881a4aab9c1fb6cd83aa72442bb8429885cd7598ee0bccc3a549322b324d499ad3b0da2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
memory/328-94-0x0000000002BB0000-0x0000000002CBD000-memory.dmp

Filesize
1.1MB

Download
memory/328-93-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/328-91-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/328-88-0x0000000002BB0000-0x0000000002CBD000-memory.dmp

Filesize
1.1MB

Download
memory/728-81-0x00000000029D0000-0x0000000002ADD000-memory.dmp

Filesize
1.1MB

Download
memory/728-80-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/728-79-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/728-76-0x00000000029D0000-0x0000000002ADD000-memory.dmp

Filesize
1.1MB

Download
memory/1344-54-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1344-56-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1344-92-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1344-78-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1344-55-0x00000000002C0000-0x00000000002E2000-memory.dmp

Filesize
136KB

Download
memory/1344-98-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1344-99-0x00000000002C0000-0x00000000002CD000-memory.dmp

Filesize
52KB

Download