79d38ff71c2a1bf6ca9b36515965dddb585ee992c2dddb561d77a97b895579f7

Analysis

max time kernel
9s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05014734f61a4cad1a22c617369aa1e0.exe
Size

11KB
MD5

05014734f61a4cad1a22c617369aa1e0
SHA1

493b5ac44b4e07011700a0e770f638bf53eb0e52
SHA256

79d38ff71c2a1bf6ca9b36515965dddb585ee992c2dddb561d77a97b895579f7
SHA512

296017e1b06595262e3a1666cf500c35e7eb8984fdba6136e36f4b555530f3c8e59ef45b4e44c1ebe3c8c84640d4f487d5968d44276a8a13edcd96bb17fd32c2
SSDEEP

192:EwpKdCk3FGDbC67l7rlCKbHoCw2DPzGYhA4JEI/V++lbk6VQcBg:DpKH3FBGl6Cw2DPzl1t1g6Vtg

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2572	catowerk.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1944-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x00080000000231f7-5.dat	upx
behavioral2/memory/1944-6-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/2572-7-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\catower.dll	05014734f61a4cad1a22c617369aa1e0.exe
File created	C:\Windows\SysWOW64\catowerk.exe	05014734f61a4cad1a22c617369aa1e0.exe
File opened for modification	C:\Windows\SysWOW64\catowerk.exe	05014734f61a4cad1a22c617369aa1e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2572	1944	05014734f61a4cad1a22c617369aa1e0.exe	17
PID 1944 wrote to memory of 2572	1944	05014734f61a4cad1a22c617369aa1e0.exe	17
PID 1944 wrote to memory of 2572	1944	05014734f61a4cad1a22c617369aa1e0.exe	17

C:\Users\Admin\AppData\Local\Temp\05014734f61a4cad1a22c617369aa1e0.exe
"C:\Users\Admin\AppData\Local\Temp\05014734f61a4cad1a22c617369aa1e0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\catowerk.exe
  C:\Windows\system32\catowerk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\05014734f61a4cad1a22c617369aa1e0.exe.bat
  2⤵
  PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\05014734f61a4cad1a22c617369aa1e0.exe.bat

Filesize
182B

MD5
b64e6fcb4397e4c5d29dff413582e1d4

SHA1
d4ad4aaa46e296f75b2937ce920985474939078c

SHA256
494c7b2fb8e30aa0551fca82dfbdd037aa9068d47dcb1d74b6a92b17584d2bab

SHA512
8e82d35db83ca5e1afd2c16e1e2649758e486d949b13c5d266c842c02ba93d29302321651a753af55746cd88c4fc0387ea920aca54bd455d6fbe10193b6dc7db

Download Submit
C:\Windows\SysWOW64\catowerk.exe

Filesize
11KB

MD5
05014734f61a4cad1a22c617369aa1e0

SHA1
493b5ac44b4e07011700a0e770f638bf53eb0e52

SHA256
79d38ff71c2a1bf6ca9b36515965dddb585ee992c2dddb561d77a97b895579f7

SHA512
296017e1b06595262e3a1666cf500c35e7eb8984fdba6136e36f4b555530f3c8e59ef45b4e44c1ebe3c8c84640d4f487d5968d44276a8a13edcd96bb17fd32c2

Download Submit
memory/1944-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2572-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download