bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe
Size

1.6MB
MD5

ccf141b287b56de4f8b2dadc5c9e80d7
SHA1

2595d744e3d3dd4daea8969e636cef59e7c43e8c
SHA256

bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019
SHA512

62e1047e648bf36744fb063e14d18e9aad94d6c220e40ef5a4ffe7db79d43227cbe33d56bc674de913897b7159144cfd3b2bfa0372db8e04cca352a73b6c253f
SSDEEP

24576:8cbD/e1EBFQvdyHQCCH2itrMOK7073vNzwrhyFvad3A7hJH2HSfl4WfpJYC1WrQf:8cbi6QdyB+rn/9wlCvhoS7pNWrQE9i

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2540	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28
PID 2828 wrote to memory of 2540	2828	bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe	28

C:\Users\Admin\AppData\Local\Temp\bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe
"C:\Users\Admin\AppData\Local\Temp\bade156b8eb1c4adf0bb331210ba79f9c9a54fdf434fbd1af240451252a56019.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" -s UPT4NM.R
  2⤵
  - Loads dropped DLL
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UPT4NM.R

Filesize
1.4MB

MD5
068c04dbeb88b9eadd0a40fc3c0c1764

SHA1
65e2ca692631bba69c6c6fc652eefc29d47e44ed

SHA256
062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8

SHA512
1843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb

Download Submit
\Users\Admin\AppData\Local\Temp\UPT4Nm.R

Filesize
1.4MB

MD5
068c04dbeb88b9eadd0a40fc3c0c1764

SHA1
65e2ca692631bba69c6c6fc652eefc29d47e44ed

SHA256
062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8

SHA512
1843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb

Download Submit
memory/2540-4-0x0000000000170000-0x0000000000176000-memory.dmp

Filesize
24KB

Download
memory/2540-5-0x0000000010000000-0x0000000010167000-memory.dmp

Filesize
1.4MB

Download
memory/2540-8-0x00000000020F0000-0x00000000021FD000-memory.dmp

Filesize
1.1MB

Download
memory/2540-9-0x0000000002200000-0x00000000022F3000-memory.dmp

Filesize
972KB

Download
memory/2540-12-0x0000000002200000-0x00000000022F3000-memory.dmp

Filesize
972KB

Download
memory/2540-13-0x0000000002200000-0x00000000022F3000-memory.dmp

Filesize
972KB

Download