Overview

overview

7

Static

static

7

1403b57b6f...e5.exe

windows7-x64

7

1403b57b6f...e5.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    98s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 09:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1403b57b6fc03fa9f4aaf7739b7a98e5.exe

  • Size

    938KB

  • MD5

    1403b57b6fc03fa9f4aaf7739b7a98e5

  • SHA1

    9b5535320c94c4c18bc9c6fcee496810b88b57eb

  • SHA256

    e80f25113d9925518637d4b462e785f1931d62b27c873a2e64c6b69db9c1e242

  • SHA512

    2fcbf7371ad6c93f06ef7850b05b15f26c0648d52a46dce78c33b6d16a393c6fd5c060a51cf786645a8e577046e33e3c0349109c3fd778e73cf667eddc7e713a

  • SSDEEP

    24576:8NGkKgD+hgOq71jCcB6PCzVxORE1cip6I:8NtKgD8unB68V/

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 47 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1403b57b6fc03fa9f4aaf7739b7a98e5.exe
    "C:\Users\Admin\AppData\Local\Temp\1403b57b6fc03fa9f4aaf7739b7a98e5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\v3exclv.com
      "C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\v3exclv.com"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      PID:3956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\V3Pro32e.DLL
    Filesize

    84KB

    MD5

    967446ba84e660b6eb81c599df8c6086

    SHA1

    0643d859a5787fb7ffbd7832c6462eee4a35289f

    SHA256

    3d556a83c350ab14ac01fd636fd0d16887e3ea034ae44fd47f80be33f29ba2aa

    SHA512

    437f3a448e27a68663c1f391c568f56a393296cf9e5aefbe94a1d4101a7aebc84071c54c0776eb649e123150e9c46d457deea2b63f5d0c77810b29060ebea3f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\asc_com.dll
    Filesize

    76KB

    MD5

    25a48d5f1c7e1ecf56349e99ac4fe587

    SHA1

    33da9c884bc9a106ea3eff4e452a98b17126b18c

    SHA256

    2bf4ab285c7b25c96c3af7edf15be8dc834bb8d0f8814b4015b19580d1b43965

    SHA512

    30368c4bbf2571dfda0a5c4f61f33f862e58b2145466e0dba6a456fe817dbf5d2b2becdf2856cd640546df70445486deebcf4b736244c70a71d2f73c9f10fa12

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\asc_dh.dll
    Filesize

    60KB

    MD5

    fa16c3c46433ddf96ae4133c7812d9a1

    SHA1

    bf7bf940db50e116dd19e14d01ebd7336498b543

    SHA256

    bc8a62405f74612239c1b1f5bf4bc1fcd92f00dc335ce942ef18c32979002cf6

    SHA512

    c6d84fe8fb4c73dbeef386167116b700d9fbac833c09d45365ef78902fe1daf17c39c86b66ca104c98dcabd9b41b71dbe7658d20bfed10f8f5977423718cd803

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\asc_mmgr.dll
    Filesize

    104KB

    MD5

    c8f48081f27e2aad229bdf6ceef83a7c

    SHA1

    f6af2fa8fd642163ebb9acbba4a6ef892fdecd90

    SHA256

    a2ec617bead7996162984299620010d39e385fe443f27ea8b132f5c766c70587

    SHA512

    b4cab1de77cd5ae780a8319b245b6d4127630cf7db6cca4d6b0759efacfb7553f7445e2a6b601cafea8bf5ef699ee6af8a44e8015b5795cfc59d046bbbb8100f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\asc_reg.dll
    Filesize

    48KB

    MD5

    eee91a17d52a43a3ff3e9bb15cc602b4

    SHA1

    8321c2db8ff583b462165576c2e7d7625aa30cb3

    SHA256

    95c3e63cf09a7e202e4b6a32f2d3c2182539eb94e40014f9612a3b8bac46098d

    SHA512

    075096104d7d3ed32ee79369bd8f34ff6737e92f14b527b8576e61f425fe58b167846c1e6d2f9c9667d6648a168edf2736bfe89e7dd839b0f2de5a354f2cb5f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_base.dll
    Filesize

    28KB

    MD5

    cfdd6ab4f9c97f1e1fbe0be8eadf3ae3

    SHA1

    cd0de385fb45b1001a26ca598515a8c940c94436

    SHA256

    28300742c0ed933f246faa52f0aac1ce7b7fdf3eb3b32757b8e456e9def56732

    SHA512

    2cb13cc965a99bf08710e14b06b9e952b3e0ac08fbd4368e4243245f96850aafa5aa5f9f9ff21b6c31164c2570546fc8e427461adfa707cb8a50d1b3e9bb9198

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_dos.dll
    Filesize

    89KB

    MD5

    185b5a3cc6c75ad9e6a0b79355d26de8

    SHA1

    21bc8dc3026a9ce096555d9490a2786873acc06a

    SHA256

    5524a47d48d8aeac4a46d10a0a3c9c39a7c1891c4638ca4c750e44a6f1bdcb77

    SHA512

    1ea357ba6ec62fda85116f7dfa6900f223001bc2edbb3b67833e24dc8ccc3c67d6102c2781b4e034ced7c29d1b23b1a4f593f3fe948e7d3d3790b5d55f6e6c29

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_dos.dll
    Filesize

    105KB

    MD5

    2a370b552ff38aff69ee36fb6d871767

    SHA1

    edcc26a15a9114d59d4d4bd18e1a0d67febdc01b

    SHA256

    c9c1e1c82d744c943f2f167c9860b552575fffc70f3d6041318e76786fad1a1a

    SHA512

    a3e3932ae837619202b3f7893ca3c6d46a22d8883cba3cb3f2ce47da26a4a08097ada47979f0a978387f59616e762ddd2acff4fee657c432fe1fcd085c364a18

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_dos.dll
    Filesize

    92KB

    MD5

    ee373bd16655a07f78546fa469da88a3

    SHA1

    8b1f43126ad70bc956f5b961cc96eb03778bb895

    SHA256

    e241aabcd7dd551f696108ac9a0a4b810257208eb7d9307c70fe4178bab09738

    SHA512

    3e31f2e2a274d336bcfda69467664eb6b4d12e44d2359b8f400dbd14e04d47747e27d590163a376a1809347509457b5718549b0cabf77b8727512e5079e72b4f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_fact.dll
    Filesize

    24KB

    MD5

    458aa27811be4f00fef8fa462d9bea4a

    SHA1

    93fa1ad95300d3804099029378d719e22a93096d

    SHA256

    c66a1eb7a2156c4ff425728ed36186b5643f06401ecc3b46dd0517caf7f6a7aa

    SHA512

    030e5f0ffacb13570b2704ff6d469de042980a47b07ea3c683c47d5895fac9da2ec6f341997918483240fdca7b14c616feb70e6e093d29c1c3040639407974ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_file.dll
    Filesize

    71KB

    MD5

    d931fcea38cac1c2eea4b2322d60de97

    SHA1

    bf0073e0aefc757c76d2e72472b7f2fa8ce0b0b6

    SHA256

    29c03974607ab3a56fba1a23277b1e77b94e8876c15623718d949df5d0bf623b

    SHA512

    462d62be814959ef1fc037088bb25ddafab9d3a99dc22273b75e34ba02cfef5990859acb09338f29e5f1dc2751bf4db7dae83efdd3c0e02531a11a65cf4c05e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_file.dll
    Filesize

    74KB

    MD5

    d3e76fb6912bd530c1885ea1fd5c85ce

    SHA1

    76552af52ccea4725cc5f8b417fd1f399c4769b6

    SHA256

    e11816c29364a2bf30b22a9af6f15a13812d603d629ad1eec2997b695fc8269e

    SHA512

    28cdcd462a9c198e69d2ed004f8e0066c207c3317d5d1b383e362a235ee91b8ef3e651d7e82cf6816da9a6731fb2388252fc61bc0cff59ef418b2579810e2cb4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_file.dll
    Filesize

    120KB

    MD5

    82ca38c94e3be4d5bd56ef38b44171c5

    SHA1

    d72b8ddfb003948538ba0d59887f0c37ccd3bbf6

    SHA256

    67e8f9908cdb8a1ebe353f4de921f95b4659de95ef15dd37fe23e6c87da9ba49

    SHA512

    5c7cbc7985a22623f3841c8335c82e3c4d154291e9a678870eec653f6d49a9c624d10f9c274ca4242d5805c2363d793a5a7e72b4420e1b9de56010f9d181b14f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_pe.dll
    Filesize

    52KB

    MD5

    ec0fc5c7f82660c880a78a9e767fbacf

    SHA1

    56cd2b95bf727ba3e1002728cd5270024749214b

    SHA256

    b22803dc0c2ec0febc03a40617ff69b4ae7f81238522aa8df51c330707b8cd93

    SHA512

    e967534b33bd20f507e8614d6ce03617956f06077bc989f677df9e87a3a720b9a57de9af7ae15fbd323267424fb635e8b14d518df30217bbf270983e6e20c579

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_pe2.dll
    Filesize

    138KB

    MD5

    e0d20dadba4a1e236183588278fa2e26

    SHA1

    b764f1a1061fdc8ff27963da1a3ec8204b9aa438

    SHA256

    811d9dfe732ae79521f210ae18eaf6148dde724b4db2501e93b63fb51f8385bb

    SHA512

    9f6bf3a49e3b7fe8cbc94d298e70e7259a99958257bcc1686d17484cab2f517fb2a2090fd43e767933dccdcb43478c7c6f1294af2020e8a5f28565141c318e2e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_pe2.dll
    Filesize

    87KB

    MD5

    c260598d50c987ae0b971ae702d13182

    SHA1

    8cfcf9112a5e6665ace2c8aa45d0e6f094877acd

    SHA256

    53217ea9dcca69dc030d2331ae169ad82845d66bb25c486357bb9f615d7421c0

    SHA512

    4d8b7539841812af4b3029db0348180a048e9585ab33a779de9d2a8a900927d8a148e11b9b295e86d27e336b2d3838fa90a755994414565a91c8b2a058e07d69

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\fse_pe2.dll
    Filesize

    64KB

    MD5

    8b0c77d0dff608c940ffae6aea866abe

    SHA1

    2d15c30d28ae8acccdfdb658aa070b61f31837bc

    SHA256

    117737d26ebb5f8ebc9295e9282490d666f0fd7a57c2c434e6024f10955b3a21

    SHA512

    7c1070b30440eb7007ebbde0d418563f102ecb3cf6b3ca0ac9894cbd729afcfae04c0fa1f94dd04a234689abb07cee9e92c5762acc8e558ac93e7f060e3f206f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_base.dll
    Filesize

    28KB

    MD5

    bb6f4c705b6ff37a5b8317595ce645b8

    SHA1

    c875a10888f1a736fb60d26db6afe0fcac285f77

    SHA256

    5b742b73b1b568d5f0d08d8e2c5f5a24f59faa1d5a05067956212d5770eb34a2

    SHA512

    ef28ede274921b1aef26e0f4aa4ab5e390afdce5067c01586429365f3c880341846c424bfa501c84d26ed5a33a4047e4c56d5ede2b13024426bcf57c1aed9c1a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_fact.dll
    Filesize

    24KB

    MD5

    edcfbad0cb2233879d379a67404ef718

    SHA1

    76a29792c2433e14829f54592be1a662b448e1c0

    SHA256

    4c8b3bf7c0f9ba1accbac2cde9021e2d975fe7ace40d6a028e15c57468fad841

    SHA512

    957f5180684fb536731442837101e7683db665df2be1865be1413f1bf7afcaf9c844b490b422f00a14d504f9d86930b12efe9cdec83ff40c56e230b5201e223c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_file.dll
    Filesize

    32KB

    MD5

    23beb506f84a5255ec954edb65e8df9c

    SHA1

    0669373432998a5e4188b59f4b18e37f677c1f9a

    SHA256

    a9580d3761b73bfa05b698021960f3e656424ef96921f9ca1f53bda8a88a3a0c

    SHA512

    511ed9d693c5a87e7c2644ca76ad5339f12e380e7e99e6ff677355d34d01d54f01ec397319d20ea734b55851ae94b50b69e9a3f57db6c88a6c96cbc59c190541

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_mem.dll
    Filesize

    28KB

    MD5

    e77337af666e49b6c03a03b635bc0149

    SHA1

    ce1a11e2778e657cf29fd1cbb7f1770fdab60207

    SHA256

    90f44637c6e2c9035182d2edf5906d0ed422b9d5cb5926349c07b7fbd9499c78

    SHA512

    590fe2c9363123109f1935f86a33a20f8f8e794ff8df6247910c1cc515d0afb18dd104c856432392999b904a580dbc72e10fb295b82b544ee2e405e49d824acb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_ole.dll
    Filesize

    52KB

    MD5

    b08695b49d82513c65a213e709e5c888

    SHA1

    d87eafa21953aadcbc7e8c419963e9a2a98fe7a2

    SHA256

    5b8bcdc26aff6e89a17e8f07c817357c524ddfc1be25bd21d12019ca87e63b62

    SHA512

    b58546d98bc27722008b1b8dd3a141b0af5ad09aae5a782e8f3cf85d15a3b463a74015b909fe6566ec8b3a20d3df5c5d5ea73ed9cdfe67dcc072500abe284a77

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_os.dll
    Filesize

    32KB

    MD5

    aff4608aa62ee0bbb5e450e5bd4b2b20

    SHA1

    16a163dae8995f1bc12094504ac2adc5c82c099d

    SHA256

    b7b6cda93d6b2e86c7685f7ae124ad171cc72b7bbb113324f6a923185ab78bb3

    SHA512

    45171337235987f3dcb12bdd02ed273640065ea085552c067e005b8f45735ecd840c8b3b4992f65068c31ccd69280f1be3e7fa0644e01e71cb8e2ba3a3155349

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_proc.dll
    Filesize

    28KB

    MD5

    057fd4277a4254912a0feec90c007dae

    SHA1

    81ef4ab2a6088abd4ac40662168592177a8068c9

    SHA256

    13217d27a495ab4d0f4cb1876c375cfc6e368276d25d66aab1951c6c8ec68eb4

    SHA512

    551caf479cd728e72a1dc0dc7a4c04ffe7988c3c150b0cb66f1dddd9460d899283fdbfa890cb8c9d0b6827fb23c769855f4ff4ee25da6f5b73e85bd78708f3ec

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_strg.dll
    Filesize

    28KB

    MD5

    fd938a88ff702e34a61f6c8f081b6f6b

    SHA1

    0c82b73554768448c53c8034d4a63420b42073c8

    SHA256

    dbd5ffee4d5756fa2d7080d74bbc11908a9a32fc6420ac5b96bbcd6fc6b77ba2

    SHA512

    c69aa2a39e5cd1493963fb9224f919e8066bc7bd80b741502ff84f7a8a61de4631ae670bff9cbc80ed6350d3da78872c10a6b15586184ea9713286c89bd47148

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\gfs_util.dll
    Filesize

    28KB

    MD5

    05dfde73f04974b1000fca69a2b33886

    SHA1

    b57520ca3b27701d26f4eb29239890c433565072

    SHA256

    dd124d1e8fd7fd405f1831310044b97196e748a05c8d7116d89559c20d4a0fe1

    SHA512

    666b68abc5c26073f7ecb9864c609d9e32733ac3b6d605c92cf55d00a11bec60540eeaab780cdff9f27b5b06dc4060d10355e525156246b3c8b722884b58ab1c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\moduler.scd
    Filesize

    4KB

    MD5

    ad08393db96018510fa087b53e5910ec

    SHA1

    6efcb6a8be2cdcbf881ffe1c1a79a29e05a1989e

    SHA256

    d45509da09e665d54f45a3f5a2735120bd230681c558086c3850a7b9e1550986

    SHA512

    60afceea82f2414d7144c5bf78e36afef87e6ecf2a2a6e427f3f1a50a455a23fb466a3847e0680cae7084f035b8de9083cd47c4da734d166e25722e4c5df19f1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\modules.scd
    Filesize

    683B

    MD5

    e006bca1385916bf619a33428766702c

    SHA1

    c54800c659956b6b22c19fec14024a6f9bdd9ebc

    SHA256

    a0c448e28cafbf0e2244bdf0cf3df631947b805e7a53267dd7c8280018ed3196

    SHA512

    2691a13181fff03640083413a0e3c68b7cb58850872b332ff23a9274c8cc5a0f325a95f7a2e516bc68ba48f18cd72e0c7c2f10665c592f3c6ea5e98f8fa1c0fc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\v3exclv.com
    Filesize

    84KB

    MD5

    3b551e8b709816cf74ada913c30057d4

    SHA1

    87c4a7e5bf6b612a9b4fc4f62b9f0be1791c49cb

    SHA256

    e7a180dc4b9af0de359c1588e52aa9e4f70eda94473a0d07b520b13aa56a7db8

    SHA512

    0dc0a4aff2ed877f2d64b3c543b7e1d69feec5855962ad11eb789ff67f85b3dd6420e90f754925f4459ae9c8efaf1079b153c58245d5fdefc8e3523fe4e513e7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\SFX569C.tmp\v3pro32e.ini
    Filesize

    66B

    MD5

    648e0d6e7773962974d52ea9549e128f

    SHA1

    3ffbe7c2a89c1d39a2ceddcf003e57f3a274853b

    SHA256

    9ef46568fc72ed56506d6119958c78a41ba4de78cf3e4ff18d1d5ca950f639d3

    SHA512

    e5f195076d943bc84615bb3fdf5c040398738287c47c143680d14bf1884aa4e6b84820b0b61dae5728746f2f3b1cf97f83206ecf5f9b30b5216865be32cd8c81

    Download Submit

  • memory/1016-90-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1016-0-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3956-142-0x0000000002130000-0x000000000213C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/3956-138-0x0000000002120000-0x0000000002130000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3956-161-0x0000000002220000-0x000000000223E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/3956-128-0x00000000020F0000-0x00000000020FD000-memory.dmp

    Filesize

    52KB

    Download

  • memory/3956-101-0x0000000000590000-0x00000000005AA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3956-149-0x0000000002150000-0x000000000215D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/3956-153-0x00000000021C0000-0x0000000002218000-memory.dmp

    Filesize

    352KB

    Download

  • memory/3956-166-0x0000000002260000-0x000000000226A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3956-165-0x00000000026E0000-0x0000000002734000-memory.dmp

    Filesize

    336KB

    Download

  • memory/3956-106-0x00000000005E0000-0x00000000005F3000-memory.dmp

    Filesize

    76KB

    Download

  • memory/3956-157-0x0000000002160000-0x0000000002195000-memory.dmp

    Filesize

    212KB

    Download