Analysis

  • max time kernel
    121s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 15:44

General

  • Target

    dedd51c9fabee7ff2dcc43d2279ada19.exe

  • Size

    1.5MB

  • MD5

    dedd51c9fabee7ff2dcc43d2279ada19

  • SHA1

    94c22dc9c49a1737a7c01847e5da4ed864151067

  • SHA256

    e10af0c9046f726797aaa27f13de5c9068f7aaa73468490b91ad11fdcd4028ca

  • SHA512

    e89c9ad247078066d96073c3262e2f93a0f071472d1ecf06b54cb0084a6353d57a420f7dd34cd6542c40b7e2ab67b1194645f4238441810c9bf34f67ddc97c63

  • SSDEEP

    24576:rs2Fs/lC51sZsm6bdcjukL2N3I5hC2TH5tY9NlqMcjukL2Y:rPFsty1sZsfdcakLWqhC2TH5t8NlqMcl

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe
    "C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe
      C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe" /TN WAgLRKqP8c0d /F
        3⤵
        • Creates scheduled task(s)
        PID:3004
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN WAgLRKqP8c0d > C:\Users\Admin\AppData\Local\Temp\Mdm58cVJD.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN WAgLRKqP8c0d
          4⤵
            PID:2648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Mdm58cVJD.xml

      Filesize

      1KB

      MD5

      04a65782e08072a6a420d41186883524

      SHA1

      d11e4e0b3f167f97e84c3ae84305259944540c9e

      SHA256

      f3ff8c98d68e89c035e98111dba9265aa1aea310f2a6a2518ba678370e39c7cb

      SHA512

      70d433bdcc50042626e0754a70faedbd44bebce9d3a0ed96268c438baafb79e452cbbcc84bc1fb18126bad0fe4232b1a6437b15d96d8dfb035b9d6fee8e067e9

    • C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe

      Filesize

      160KB

      MD5

      6b5bccae5fec35f63f4a073d10e62b68

      SHA1

      432c56a46d4c442e074218bbbc5f4792c443b0a6

      SHA256

      63e39e23f890fd3683e11db720c5f4a1791dab87f8849533f8d9b8e4cd20c3c3

      SHA512

      216d206961b1afc90b49f9ff101001c9ff07334bcb22b2ef6c4b615fdf80d01b40bdfab28cce9cc872246f700a93ff100bcc80a5c8463789585cf2dbcc3084b3

    • C:\Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe

      Filesize

      328KB

      MD5

      c4b72824f1393ce6892d783d4a69a708

      SHA1

      7023c7d36c7eb85279776a8a335af5ff0833ccda

      SHA256

      c8a993d796d0e2cb013970709a202d910b7cc83ddfcad1f5e6f7ba6e2bb02299

      SHA512

      8b4f6b6752a650e82b267c78719b2372df97306c94a84c9f0e3ea9c2dbf75730bc1c5a14c1b6401d572a5ccc0a79f7316ef60c2ee2d19b48e0ba446bfc6f9b98

    • \Users\Admin\AppData\Local\Temp\dedd51c9fabee7ff2dcc43d2279ada19.exe

      Filesize

      415KB

      MD5

      519b0e910235cfa0b3b8b93ce0f8d0ce

      SHA1

      4cd944418713c2d846b81f194576c42e5e92f481

      SHA256

      4bc7e48636fa411744da67e0e858798f9657870eff4206f5ed053482425c92b1

      SHA512

      105e93b3f61a713444a2018938634a2312a15e800e418f8cc341df05070f992ec4df90c934e377b0de4671b8fb7551d8195f0b0529e316eb246b4cb31566b8b9

    • memory/2612-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2612-17-0x00000000230D0000-0x000000002332C000-memory.dmp

      Filesize

      2.4MB

    • memory/2612-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2612-5-0x00000000001A0000-0x000000000021E000-memory.dmp

      Filesize

      504KB

    • memory/2612-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2672-18-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2672-20-0x00000000002A0000-0x000000000031E000-memory.dmp

      Filesize

      504KB

    • memory/2672-26-0x00000000001B0000-0x000000000021B000-memory.dmp

      Filesize

      428KB

    • memory/2672-27-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2672-32-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB