f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/10/2023, 05:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe
Size

647KB
MD5

4cceb1f483d134121bccc057066deef5
SHA1

97026fd33557aced183e408950adba2276bf7ff9
SHA256

f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3
SHA512

a49984411ff20bb1eb107432985f0a4496029ac8ccf6c00147017aa6dae19538aedebfc4950ee8d0f2fd38fa707e085a8aed6fc52aed38da5a4a348d16b884bf
SSDEEP

12288:1+bK4Z+8EAsu851K3x1qIBdo+XPQrnAOCywQMpCvYT+v4se+COsPRvkKE0LOed:0iNAsL1KSIBjSXwxc4sJCOsPOcL9d

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2764	noMeiryoUI.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x0000000000C50000-0x0000000000D78000-memory.dmp	upx
behavioral1/memory/2876-81-0x0000000000C50000-0x0000000000D78000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2876-81-0x0000000000C50000-0x0000000000D78000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	noMeiryoUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2764	2876	f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe	28
PID 2876 wrote to memory of 2764	2876	f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe	28
PID 2876 wrote to memory of 2764	2876	f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe	28
PID 2876 wrote to memory of 2764	2876	f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe	28

C:\Users\Admin\AppData\Local\Temp\f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe
"C:\Users\Admin\AppData\Local\Temp\f7b50a1d4ebedd679d5b959a158eb964316c09b0d65a0bcc794652d3384656b3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\NoMeiryoUI\noMeiryoUI.exe
  C:\Users\Admin\AppData\Local\Temp\NoMeiryoUI\noMeiryoUI.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NoMeiryoUI\English.lng

Filesize
3KB

MD5
627a63c900f0df9e8106508d0215690c

SHA1
a8fa3f89e2b389d9148d0c5ae4f46c3b6c17c55a

SHA256
00beecbf4ebb95fc1cdf94c04ea9c3b3ef077be8d246307c0135e9422c246199

SHA512
6501015820590ca1458e5726d63b5f764a8a97ac633acb0acb590dcf9482526b3b8e3fcd594a58887c8c42cd63965d4861b8380999476554536a31fe281977f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\NoMeiryoUI\noMeiryoUI.exe

Filesize
180KB

MD5
f5cff75a6d8349023c76aef961081cba

SHA1
420143f0e5a4f9cdd3dd1ccdb810574395e7923a

SHA256
b931dd4c38ea090724532552a9e0a4843e5c4a95cb9a2e2ef9cbc039126ee95c

SHA512
d756c8290ef63e6f97e5e5ccf8d2719521f7c76b36429d48b3ce6c3c6895d0c5ea233f9d5a3863da4206707b6e8bae6e0ff3e743f0b0de77e2b9bb0cc97b2003

Download Submit
\Users\Admin\AppData\Local\Temp\NoMeiryoUI\noMeiryoUI.exe

Filesize
180KB

MD5
f5cff75a6d8349023c76aef961081cba

SHA1
420143f0e5a4f9cdd3dd1ccdb810574395e7923a

SHA256
b931dd4c38ea090724532552a9e0a4843e5c4a95cb9a2e2ef9cbc039126ee95c

SHA512
d756c8290ef63e6f97e5e5ccf8d2719521f7c76b36429d48b3ce6c3c6895d0c5ea233f9d5a3863da4206707b6e8bae6e0ff3e743f0b0de77e2b9bb0cc97b2003

Download Submit
memory/2876-0-0x0000000000C50000-0x0000000000D78000-memory.dmp

Filesize
1.2MB

Download
memory/2876-81-0x0000000000C50000-0x0000000000D78000-memory.dmp

Filesize
1.2MB

Download