4e214aada010f0761062335b78a1bbddc879ca3bd696c7021bd3f5e8f5ab5e83

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update_dll.exe
Size

1.6MB
MD5

2ec19478c6e5f4ff9f373b275d1910c5
SHA1

01112e3d156f802059575369d039a92f95bf9025
SHA256

4e214aada010f0761062335b78a1bbddc879ca3bd696c7021bd3f5e8f5ab5e83
SHA512

3ca2eec0dcaaedd548faa363e850855479ba045d68b4be7f70592ddeb3671daa10175b21579861b764440d1cbf02dc98fcc020c217801f71d4150c0699c13b2d
SSDEEP

24576:y8Iog+CuyfdDCvi3c9FSgt4syKh8TVmRCE4kDXY1Ur3TfXK9QG0ILPp6MNvTxvwK:T6uyVex0c49KgVmWeMJXFVrJ3

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	update_dll.exe

Executes dropped EXE 2 IoCs

pid	Process
2504	p_update.exe
2460	p_update.exe

Loads dropped DLL 4 IoCs

pid	Process
2504	p_update.exe
2504	p_update.exe
2460	p_update.exe
2460	p_update.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3176-133-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3176-155-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3176-170-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2504	3176	update_dll.exe	84
PID 3176 wrote to memory of 2504	3176	update_dll.exe	84
PID 3176 wrote to memory of 2504	3176	update_dll.exe	84
PID 3176 wrote to memory of 2460	3176	update_dll.exe	87
PID 3176 wrote to memory of 2460	3176	update_dll.exe	87
PID 3176 wrote to memory of 2460	3176	update_dll.exe	87

C:\Users\Admin\AppData\Local\Temp\update_dll.exe
"C:\Users\Admin\AppData\Local\Temp\update_dll.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update_dll.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2504
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe" "shell" "update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\UpdateLog.log

Filesize
156B

MD5
ad58457f754ff037f6ed5b56f2edc292

SHA1
fcfbe7139368184246a04ba4d349a41b9724c7ea

SHA256
9c77e6aaf5157b7df9941505c7c47abf9147e14fd1660b34aaf8c24d81b8b9d7

SHA512
6f5029c5f9f806ad6cdb4e62435fd9a76853f429a6a1b240a13d89a7513eed3dbaee298901c93659c59f34113b4a96b24af221cd138da85043cb140b8495b264

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\UpdateLog.log

Filesize
156B

MD5
ad58457f754ff037f6ed5b56f2edc292

SHA1
fcfbe7139368184246a04ba4d349a41b9724c7ea

SHA256
9c77e6aaf5157b7df9941505c7c47abf9147e14fd1660b34aaf8c24d81b8b9d7

SHA512
6f5029c5f9f806ad6cdb4e62435fd9a76853f429a6a1b240a13d89a7513eed3dbaee298901c93659c59f34113b4a96b24af221cd138da85043cb140b8495b264

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.dll

Filesize
1.0MB

MD5
f03d2e73d9f63bd3feb0d193da68577c

SHA1
2a4727aad2ae342498a1afb13fc2565152b8756c

SHA256
3995014823782fc301a8c837a24d407697343187c97ff11aebb402ad7b08d48b

SHA512
efbf81d84965bc4c01f03b97aef57712215721c84a6d3e7bc2e7204152acb8085c4526084235c7448b9bab526bf7345ff453d20e96b8b2aa5868b96770ee66dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\p_update.exe

Filesize
582KB

MD5
4d01a17f0cf89fcfc80406728717548a

SHA1
370fde5d6de249e174f1c90acfc4cdfd621005c3

SHA256
06af5d8ad366df7abf725bb5b0e78c7731aa74e3594620984c415db6dbda8431

SHA512
ffe1b9cd356c21e6d98d6b1ecd76261dda07f935d84efb0de6d8a18269c004d530697054216c2354492203c8ef1aa0bd3bba013ced3c009ea9950ce8b3260adb

Download Submit
memory/2460-161-0x0000000002540000-0x000000000264D000-memory.dmp

Filesize
1.1MB

Download
memory/2460-164-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2460-165-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2460-166-0x0000000002540000-0x000000000264D000-memory.dmp

Filesize
1.1MB

Download
memory/2504-156-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2504-157-0x0000000002500000-0x000000000260D000-memory.dmp

Filesize
1.1MB

Download
memory/2504-152-0x0000000002500000-0x000000000260D000-memory.dmp

Filesize
1.1MB

Download
memory/2504-154-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3176-133-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3176-155-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3176-170-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download