78a28b25b330513649439305a5d9293cb07fb796ad6521ef31f39a5453a549d8

Resubmissions

07-09-2023 14:45

230907-r45fysaf5s 10

07-09-2023 14:12

230907-rjbyxaad5s 10

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe
Size

899KB
MD5

196c58f6fb541bce1082b908d77d19c4
SHA1

6c004c1d4a70ec9c0655a6288f5d97297583d8aa
SHA256

6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53
SHA512

e6bc0efa08a28737b2f8acca641a69276cafdf77bcc36d600c46f28a822c7fc021f0a19df6e958f5626caa848a309c29554bb98dbd4df1d2b26efc819b13b65c
SSDEEP

24576:RlQKriZKMRb54kwQppldcLrLmF0RhwF4T1sS:JEKMR94vQvlMrC21xs

Score

9^/10

evasion upx

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral20/memory/2240-0-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral20/memory/2240-40-0x0000000000400000-0x0000000000545000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2428	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28
PID 2240 wrote to memory of 2428	2240	6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe	28

C:\Users\Admin\AppData\Local\Temp\6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe
"C:\Users\Admin\AppData\Local\Temp\6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe
  C:\Users\Admin\AppData\Local\Temp\6709db0a92e59e6662708358c0197d6b72b86ff9edb798aca32e34cad1623e53.exe
  2⤵
  - Enumerates VirtualBox registry keys
  - Suspicious behavior: EnumeratesProcesses
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-0-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2240-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2240-40-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/2428-18-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-24-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-9-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-12-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-15-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-4-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-21-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-6-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-27-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-30-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-33-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-36-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2428-2-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-41-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2428-42-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download