Overview

overview

10

Static

static

3

0ad048031d...95.exe

windows7-x64

10

0ad048031d...95.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0ad048031d8ce25c64d36ffc5ff14695.exe

  • Size

    508KB

  • MD5

    0ad048031d8ce25c64d36ffc5ff14695

  • SHA1

    c0d3f8133e6fc80827c114bc2d2bf2ce83ecddce

  • SHA256

    95df2d0ea562afee026301702eec0466d21e5b41a238957aca50be8ebb60c43a

  • SHA512

    13e1965302374b8db669ce46c74d3034f30b41628c83a8c4ba5cdc5fd1b41a69d9663c861b3ec0d38b3012687913be47a0794695eb7138ffb65914bf4b3de9a0

  • SSDEEP

    6144:m3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:m3xxPuFVtSdWJsuWXLGMvxsltRok/Gy

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 17 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1380
    • C:\Users\Admin\AppData\Local\Temp\0ad048031d8ce25c64d36ffc5ff14695.exe
      "C:\Users\Admin\AppData\Local\Temp\0ad048031d8ce25c64d36ffc5ff14695.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Users\Admin\eosRo6jbz1.exe
        C:\Users\Admin\eosRo6jbz1.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Users\Admin\wuoubaj.exe
          "C:\Users\Admin\wuoubaj.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2156
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2688
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2892
      • C:\Users\Admin\2veg.exe
        C:\Users\Admin\2veg.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2620
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2764
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 88
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2396
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2724
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2920
        • C:\Users\Admin\2veg.exe
          "C:\Users\Admin\2veg.exe"
          4⤵
          • Executes dropped EXE
          PID:2168
      • C:\Users\Admin\3veg.exe
        C:\Users\Admin\3veg.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1332
        • C:\Users\Admin\AppData\Local\c1d0fc3f\X
          *0*bc*974fe4e5*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:700
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
            PID:2356
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 0ad048031d8ce25c64d36ffc5ff14695.exe
          3⤵
          • Deletes itself
          PID:616
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:612
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:336
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      1⤵
        PID:2400
      • C:\Windows\system32\wbem\wmiprvse.exe
        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
        1⤵
          PID:868

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\2veg.exe
                Filesize

                124KB

                MD5

                116cdd8174ee4734183e8f019a548596

                SHA1

                d918d4e4bdaec0f4066c2285a5bd85903d92e23f

                SHA256

                dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a

                SHA512

                377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933

                Download Submit

              • C:\Users\Admin\3veg.exe
                Filesize

                248KB

                MD5

                043c584ddbd2d8972f86d668b9fe6486

                SHA1

                55fa7cc938d31def14160fe575f133c0e38a4fd8

                SHA256

                71ae0007315b231c8f3b5ac4175073b1a1a2e0bbe6ee3451015d547aeac736d8

                SHA512

                5e9b1cb0995e5954c607d73218957c3e9b6449c6ddff955550080dd7c1e9a3cafff533532854e0a5794dc81f60048e52b60e278f3e4aac7e3c1bc784b972996e

                Download Submit

              • C:\Windows\system32\consrv.dll
                Filesize

                29KB

                MD5

                1149c1bd71248a9d170e4568fb08df30

                SHA1

                6f77f183d65709901f476c5d6eebaed060a495f9

                SHA256

                c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

                SHA512

                9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

                Download Submit

              • \Users\Admin\3veg.exe
                Filesize

                287KB

                MD5

                357d9b4488d3191b0d6197015b326484

                SHA1

                057455015523d5b0b475dce4a49d510ba6a23ee4

                SHA256

                7444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36

                SHA512

                f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc

                Download Submit

              • \Users\Admin\AppData\Local\c1d0fc3f\X
                Filesize

                38KB

                MD5

                72de2dadaf875e2fd7614e100419033c

                SHA1

                5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

                SHA256

                c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

                SHA512

                e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

                Download Submit

              • \Users\Admin\eosRo6jbz1.exe
                Filesize

                180KB

                MD5

                582c4af3c13d489f7593c6655a9ed25f

                SHA1

                f920f89e59010c5d24507a3556cfa2b8ed406ddc

                SHA256

                560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5

                SHA512

                f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d

                Download Submit

              • \Users\Admin\wuoubaj.exe
                Filesize

                180KB

                MD5

                9838a6d31d1f62eda3b33009392ef54a

                SHA1

                88bb0941dba9ef6e3347d67666b07d2f2ed304d1

                SHA256

                a63434dd10a69107b2ad71d96d46e15eadc105c1811550e155146999b437e04f

                SHA512

                d8e68ccf1cbc1addf1652018c61c2353058bdb0feb84c578486ce84d040d984047062fb173c2d9a2a499b606f959d511bc62165c465121be6b467e6af033bfd7

                Download Submit

              • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
                Filesize

                2KB

                MD5

                40af3963a79222555eb57f76af1a8201

                SHA1

                e6a76cf1b85a7142d3adc3f06fc640afef737118

                SHA256

                e498cf69c90534654d96aa90205429ff9668b0273c9c1c4490626086a1dc163f

                SHA512

                7a91bfb7ce9b1da411dc3abb2d289a0c77cdcaed9df0818f94e206a1660c2e114ca66e2ab9282f1060bcd4764d9cc0608905b17b98e44a15dc91d4bb3de616ac

                Download Submit

              • memory/336-173-0x0000000002B30000-0x0000000002B32000-memory.dmp

                Filesize

                8KB

                Download

              • memory/336-141-0x0000000000C40000-0x0000000000C4B000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1332-169-0x0000000030670000-0x00000000306C1000-memory.dmp

                Filesize

                324KB

                Download

              • memory/1332-170-0x0000000000390000-0x0000000000490000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/1332-121-0x0000000000390000-0x0000000000490000-memory.dmp

                Filesize

                1024KB

                Download

              • memory/1332-120-0x0000000030670000-0x00000000306C1000-memory.dmp

                Filesize

                324KB

                Download

              • memory/1332-174-0x0000000030670000-0x00000000306C1000-memory.dmp

                Filesize

                324KB

                Download

              • memory/1380-158-0x0000000000C40000-0x0000000000C4B000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1380-159-0x0000000002B70000-0x0000000002B7B000-memory.dmp

                Filesize

                44KB

                Download

              • memory/1380-133-0x0000000002B30000-0x0000000002B32000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1380-124-0x0000000002B40000-0x0000000002B46000-memory.dmp

                Filesize

                24KB

                Download

              • memory/1380-128-0x0000000002B40000-0x0000000002B46000-memory.dmp

                Filesize

                24KB

                Download

              • memory/2620-59-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2620-122-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-57-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-54-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-47-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-39-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-41-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2620-43-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2724-92-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-66-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-163-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-73-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-76-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-90-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-71-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-86-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2724-87-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

                Download

              • memory/2764-50-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2764-61-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2764-65-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2764-64-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2764-55-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2764-67-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2764-52-0x0000000000400000-0x000000000040E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/2920-98-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2920-165-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2920-104-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2920-107-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2920-102-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2920-94-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2920-91-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

                Download

              • memory/2952-26-0x0000000004150000-0x0000000004C0A000-memory.dmp

                Filesize

                10.7MB

                Download