b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 04:45

Target

b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe
Size

586KB
MD5

0773765a95d36fe166c8b4f8a3ee99b5
SHA1

8d7b1340f70329798d1b1babfcf24b3ae7e85b18
SHA256

b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962
SHA512

8be00e78d96b87372f61d4ff821aeac567a7af01478cd5503a383904d6d7bb8e5ac1a152bd9525f245ccf889aa3a3f2dc4e610f20469d30d0714e5682b4fee65
SSDEEP

6144:pd/KgYOA+2gT5bmOt3MP0BjLMnjsx3cmpWcPhQ4mPVcJz7wfXfeZ8YjvrVeUWVmS:pdgOhRYMcMBknjST8s2y7wne6icuM/

Score

7^/10

upx

Executes dropped EXE 2 IoCs

pid	Process
1508	PsExec64.exe
1204	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x00000000005A6000-memory.dmp	upx
behavioral1/memory/1724-8-0x0000000000400000-0x00000000005A6000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PsExec64.exe	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe
1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe
1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1508	1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe	28
PID 1724 wrote to memory of 1508	1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe	28
PID 1724 wrote to memory of 1508	1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe	28
PID 1724 wrote to memory of 1508	1724	b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe	28

C:\Users\Admin\AppData\Local\Temp\b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe
"C:\Users\Admin\AppData\Local\Temp\b51c561612ceb554289b0e188716d2aefc7034d2abc0f1663e298372afbe8962.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\PsExec64.exe
  C:\Windows\SysWOW64\PsExec64.exe -d -i -s C:\Users\Admin\AppData\Local\Temp./2023Äê11ÔÂ13ÈÕ4Ê±45·Ö34Ãë..exe
  2⤵
  - Executes dropped EXE
  PID:1508

C:\Windows\SysWOW64\PsExec64.exe

Filesize
366KB

MD5
9321c107d1f7e336cda550a2bf049108

SHA1
fb0a150601470195c47b4e8d87fcb3f50292beb2

SHA256
ad6b98c01ee849874e4b4502c3d7853196f6044240d3271e4ab3fc6e3c08e9a4

SHA512
5ac1dac5061dd14c1d79d2910c4df6ed059059c7d3f987ebe9790626c327d5fa9c7cdbb4150c004d14750223f33b4fc27fa16b3681371d406c2b715ba757be0e

Download Submit
\Windows\SysWOW64\PsExec64.exe

Filesize
366KB

MD5
9321c107d1f7e336cda550a2bf049108

SHA1
fb0a150601470195c47b4e8d87fcb3f50292beb2

SHA256
ad6b98c01ee849874e4b4502c3d7853196f6044240d3271e4ab3fc6e3c08e9a4

SHA512
5ac1dac5061dd14c1d79d2910c4df6ed059059c7d3f987ebe9790626c327d5fa9c7cdbb4150c004d14750223f33b4fc27fa16b3681371d406c2b715ba757be0e

Download Submit
\Windows\SysWOW64\PsExec64.exe

Filesize
366KB

MD5
9321c107d1f7e336cda550a2bf049108

SHA1
fb0a150601470195c47b4e8d87fcb3f50292beb2

SHA256
ad6b98c01ee849874e4b4502c3d7853196f6044240d3271e4ab3fc6e3c08e9a4

SHA512
5ac1dac5061dd14c1d79d2910c4df6ed059059c7d3f987ebe9790626c327d5fa9c7cdbb4150c004d14750223f33b4fc27fa16b3681371d406c2b715ba757be0e

Download Submit
memory/1724-0-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/1724-8-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download