3a555a7b63808b04ad9819f020ee104fdd8628b60dcffe8bb276901d965d52b2

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b64a50d5bd8406202d8d57dfee172db.exe
Size

124KB
MD5

4b64a50d5bd8406202d8d57dfee172db
SHA1

6e0d14010cc5883840e17546e5b03f1b98ca58fe
SHA256

3a555a7b63808b04ad9819f020ee104fdd8628b60dcffe8bb276901d965d52b2
SHA512

9a3983ac24bb2fbdfcfd124bb2283b426c42cd930f8e9040777b88c2809a8ac04f17d7f7d0974bccf60c65573a17f233d026bc62efe9aca8d9538d3ed99f5500
SSDEEP

1536:kjqGUXJ2q4D4o+Ny6NK4RKB7AWe1uvYV5eRiotRQNJUxAd6HwAYb3Z:kjqGUXJxhog47/e16YMCJ98wAYb

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
848	cmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	4b64a50d5bd8406202d8d57dfee172db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 848	2220	4b64a50d5bd8406202d8d57dfee172db.exe	28
PID 2220 wrote to memory of 848	2220	4b64a50d5bd8406202d8d57dfee172db.exe	28
PID 2220 wrote to memory of 848	2220	4b64a50d5bd8406202d8d57dfee172db.exe	28
PID 2220 wrote to memory of 848	2220	4b64a50d5bd8406202d8d57dfee172db.exe	28

C:\Users\Admin\AppData\Local\Temp\4b64a50d5bd8406202d8d57dfee172db.exe
"C:\Users\Admin\AppData\Local\Temp\4b64a50d5bd8406202d8d57dfee172db.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Nxb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nxb..bat

Filesize
210B

MD5
3b033430ff1a3ec1f7588071201e933b

SHA1
587ec3840b078800224d13bd42c968871011e91f

SHA256
60ce2c4b99cc8e031167e0f94a835c89e1325fefcc398e301a9501ce3b0a8967

SHA512
4c269bdad7db8b30d84e162a5124d2410c65fda3a67468cc68b2842f64ccf55469f9585bbc9d8a1430e659d1818f7ae9bf1bae3c98731c636dbad667d780a279

Download Submit
memory/2220-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2220-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2220-1-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2220-3-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2220-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download