Overview

overview

10

Static

static

3

29585b1cb7...37.exe

windows7-x64

10

29585b1cb7...37.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    162s
  • max time network
    189s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 15:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    29585b1cb71276a7ed77119f9147cd37.exe

  • Size

    422KB

  • MD5

    29585b1cb71276a7ed77119f9147cd37

  • SHA1

    33d61f651a62dc10f995eaf964f72ff1577b6d60

  • SHA256

    474aeaba6adf60b54bdeef4cc796c1bc871d20977c4a3a376715fa1aa19885f5

  • SHA512

    ce950b592e46b86eac1aa62fada70e75de6c27db53e3343188d025156892be7a6bf33f876b46c5f5d79e17605536b5dcf598ff34b043041674ed28ba6ab7e576

  • SSDEEP

    6144:i6v0FAVlstMkm0+iKulpUW7z7rzumqE9ob4yOD4bHvX6mpktOy5JKwFwzb:i64ALx0KusWTumF9GvI4bH/6m4KwG

Score
10/10
persistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29585b1cb71276a7ed77119f9147cd37.exe
    "C:\Users\Admin\AppData\Local\Temp\29585b1cb71276a7ed77119f9147cd37.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\ProgramData\cB28611OoNbH28611\cB28611OoNbH28611.exe
      "C:\ProgramData\cB28611OoNbH28611\cB28611OoNbH28611.exe" "C:\Users\Admin\AppData\Local\Temp\29585b1cb71276a7ed77119f9147cd37.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:1216

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\cB28611OoNbH28611\cB28611OoNbH28611.exe
    Filesize

    422KB

    MD5

    bc6f05ba0f6f83cc509625243151c308

    SHA1

    88e56452bca0d48082c7c83ab03d0e3c0376e0e8

    SHA256

    11513c204c2f5434f3193131a201b8104aeac7618617a6d87825e9e4aabc4fbe

    SHA512

    4e70620ea0c50bdc0d0677c6b383ea4a3544b199ba437f0ee3141427d0f3ae1bd964b5221f292fded93dd2777b1ef5986fe107d20519b1dfce4df12fa2436e67

    Download Submit

  • memory/1216-31-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

    Download

  • memory/1216-38-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

    Download

  • memory/2780-0-0x00000000003D0000-0x00000000003D3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/2780-1-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

    Download

  • memory/2780-10-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

    Download

  • memory/2780-30-0x0000000000400000-0x00000000004D2000-memory.dmp

    Filesize

    840KB

    Download