a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593

General

Target

a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe
Size

266KB
MD5

3ff91ffbb547f8ffffcd18a20e36d9e9
SHA1

1552b29610176f4c6d50ccaaf6539820dde833b6
SHA256

a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593
SHA512

aa768a9d77ecaf4a55df27ea744d6dfe4f6793474f41131d88ad998af2fe157b12fb7fb566cc606ebd9ab40f2e4bb04ffe171bf216e976f30f3bb07bb51d572b
SSDEEP

6144:iXzKdNY49u8rVn6btCNLhV7k1QXzF5OC601net:xa4AW6bsNL/7lXiF01

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
68	ITS SB App Switch.exe
868	ITS SB App Switch.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2724-0-0x0000000000150000-0x00000000001F0000-memory.dmp	upx
behavioral1/memory/2724-8-0x0000000000150000-0x00000000001F0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe
2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe
2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe
2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 68	2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe	71
PID 2724 wrote to memory of 68	2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe	71
PID 2724 wrote to memory of 68	2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe	71
PID 2724 wrote to memory of 868	2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe	72
PID 2724 wrote to memory of 868	2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe	72
PID 2724 wrote to memory of 868	2724	a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe	72

C:\Users\Admin\AppData\Local\Temp\a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe
"C:\Users\Admin\AppData\Local\Temp\a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:68
- C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
  "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
  2⤵
  - Executes dropped EXE
  PID:868

Network

DNS

www.programworkshop.com

a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe

Remote address:

8.8.8.8:53

Request

www.programworkshop.com

IN A

Response

www.programworkshop.com

IN A

161.47.163.214
GET

http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe

Remote address:

161.47.163.214:80

Request

GET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
User-Agent: /DownloadSecureBrowser
Host: www.programworkshop.com

Response

HTTP/1.1 403 Url not valid

Cache-Control: private
Content-Type: text/html
From: ILP03
p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
Date: Sun, 26 Nov 2023 05:13:20 GMT
Content-Length: 1233
DNS

214.163.47.161.in-addr.arpa

Remote address:

8.8.8.8:53

Request

214.163.47.161.in-addr.arpa

IN PTR

Response
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

26.178.89.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.178.89.13.in-addr.arpa

IN PTR

Response
DNS

122.175.53.84.in-addr.arpa

Remote address:

8.8.8.8:53

Request

122.175.53.84.in-addr.arpa

IN PTR

Response

122.175.53.84.in-addr.arpa

IN PTR

a84-53-175-122deploystaticakamaitechnologiescom

161.47.163.214:80

http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

http

a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe

649 B
1.7kB
7
5

HTTP Request

GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

HTTP Response

403
52.111.236.22:443

322 B
7

8.8.8.8:53

www.programworkshop.com

dns

a0043e112cf16714c125c52cfdc42f8d83e99ca82f0c3e7fd3f51a4120209593.exe

69 B
85 B
1
1

DNS Request

www.programworkshop.com

DNS Response

161.47.163.214
8.8.8.8:53

214.163.47.161.in-addr.arpa

dns

73 B
136 B
1
1

DNS Request

214.163.47.161.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

26.178.89.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

26.178.89.13.in-addr.arpa
8.8.8.8:53

122.175.53.84.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

122.175.53.84.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
memory/2724-0-0x0000000000150000-0x00000000001F0000-memory.dmp

Filesize
640KB

Download
memory/2724-8-0x0000000000150000-0x00000000001F0000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.