6ac4a63b41f698b53d1fecad78ff405dab8a39265ffef4d9d03def5e7bf97076

Analysis

max time kernel
170s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a9bb7c4312b4a6cf5490eacb4a06525.exe
Size 102KB
Sample231225-s9chsscde9
SHA256 6ac4a63b41f698b53d1fecad78ff405dab8a39265ffef4d9d03def5e7bf97076
MD5 2a9bb7c4312b4a6cf5490eacb4a06525
SHA1 c2914d29b78d4abf62d3f2a7e6ef1b40bfcbabb7
SHA512 9043f26408d3e86954b4a3ce7c008e688ed4e87b6b56b9c67c6b4abd33f87b525c2c9893ba3b0827c870f805a2edfb508b4185b98b736a6491709f1bdc72359c
SSDEEP 3072:3GafMKcDnOLTHLTUYTJRTyuVzww35PrFebvFDfmVB:31GnyR3qw3JrFe7FDa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4420	bieshawo.exe

Loads dropped DLL 1 IoCs

pid	Process
4420	bieshawo.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3000-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/3000-7-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/files/0x0006000000023209-10.dat	upx
behavioral2/memory/4420-12-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/4420-19-0x0000000000400000-0x000000000041B000-memory.dmp	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023201-16.dat	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\txdayefangguowo.dll	bieshawo.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\dnf\bieshawo.exe	2a9bb7c4312b4a6cf5490eacb4a06525.exe
File opened for modification	C:\Program Files\dnf\bieshawo.exe	2a9bb7c4312b4a6cf5490eacb4a06525.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
4420	bieshawo.exe
4420	bieshawo.exe
4420	bieshawo.exe
4420	bieshawo.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4420	bieshawo.exe
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4420	bieshawo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe
4420	bieshawo.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2224	3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe	95
PID 3000 wrote to memory of 2224	3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe	95
PID 3000 wrote to memory of 2224	3000	2a9bb7c4312b4a6cf5490eacb4a06525.exe	95
PID 2224 wrote to memory of 4420	2224	cmd.exe	97
PID 2224 wrote to memory of 4420	2224	cmd.exe	97
PID 2224 wrote to memory of 4420	2224	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2a9bb7c4312b4a6cf5490eacb4a06525.exe
"C:\Users\Admin\AppData\Local\Temp\2a9bb7c4312b4a6cf5490eacb4a06525.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tr.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files\dnf\bieshawo.exe
    "C:\Program Files\dnf\bieshawo.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

bieshawo.exe

Path C:\Program Files\dnf\bieshawo.exe
Size 102KB
SHA256 6ac4a63b41f698b53d1fecad78ff405dab8a39265ffef4d9d03def5e7bf97076
MD5 2a9bb7c4312b4a6cf5490eacb4a06525
SHA1 c2914d29b78d4abf62d3f2a7e6ef1b40bfcbabb7
SHA512 9043f26408d3e86954b4a3ce7c008e688ed4e87b6b56b9c67c6b4abd33f87b525c2c9893ba3b0827c870f805a2edfb508b4185b98b736a6491709f1bdc72359c
SSDEEP 3072:3GafMKcDnOLTHLTUYTJRTyuVzww35PrFebvFDfmVB:31GnyR3qw3JrFe7FDa
MD5 SHA1 SHA512 SSDEEP

Submit Download

tr.bat

Path C:\Users\Admin\AppData\Local\Temp\tr.bat
Size 164B
SHA256 41df8a0f7174b92567884b44f4ee078b9d72bbcd88ac3d256c782ca639088102
MD5 7c26e0521eb75e3e8995233c872bdb4e
SHA1 a5abfa750029197548a306db29b71cc1b5eb804a
SHA512 f9a8330ba3d15577a35d3493864d239aed4d4944d271dc1caa40aa920f747267b572ced3512b448dc617cd7855f0023475f370b352f7538fc01f89c19f216cc5
MD5 SHA1 SHA512

Submit Download

txdayefangguowo.dll

Path C:\Windows\SysWOW64\txdayefangguowo.dll
Size 52KB
SHA256 85f8a1bd905c5f6fcd422d2958d68448ef4078254967059148747a8e91d5ef5c
MD5 2594233854c5e1b0830e2856061ac37c
SHA1 dcba067da9434ac3584831456e7ac3e976884152
SHA512 8500825dcd15ecaf43275870b4ef847ff206b755a13f8bc68799bac7d7c43b61b6ccf048cf5ad03b445f67a6668634d8e1ab39c474189c23cec63de829216db8
SSDEEP 768:iS4IsP/VKcyTRHVzIW9WwvLgNnI53/rONWGQeNH6qqkv/+7kYOXz3Pm610Z:OIsFdmRHVzwwjuI5PrFebv2GXzfma0Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3000-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3000-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4420-12-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4420-19-0x0000000000400000-0x000000000041B000-memory.dmp

Download