13eacc2ebbb71879010ec08c8df3107071dc2cd0d45e7e2b9c4414eaff1a4bc8

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f6b85388e86499d9662ad2551a41297.exe
Size

28KB
MD5

4f6b85388e86499d9662ad2551a41297
SHA1

3cd0daccc030f1de30359dc421e09f2210ba2236
SHA256

13eacc2ebbb71879010ec08c8df3107071dc2cd0d45e7e2b9c4414eaff1a4bc8
SHA512

cd07148e507936031b3d42ea54d482cb6181a75bc7c8271d3ef0388abca41914a727c0d1871cf9ccd3a64985430b8517f03ec9bb38dfe156c4732486e80c2a74
SSDEEP

768:b5/gNRhBWhue9mJhhjqe/dnp+VpwzXOiDUaurro:N/XuKmfpqeVp+KXPUX/o

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1800	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/2232-2-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1800	2232	4f6b85388e86499d9662ad2551a41297.exe	28
PID 2232 wrote to memory of 1800	2232	4f6b85388e86499d9662ad2551a41297.exe	28
PID 2232 wrote to memory of 1800	2232	4f6b85388e86499d9662ad2551a41297.exe	28
PID 2232 wrote to memory of 1800	2232	4f6b85388e86499d9662ad2551a41297.exe	28

C:\Users\Admin\AppData\Local\Temp\4f6b85388e86499d9662ad2551a41297.exe
"C:\Users\Admin\AppData\Local\Temp\4f6b85388e86499d9662ad2551a41297.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
210B

MD5
aa3d8bdf97a668977afe69628dc300fe

SHA1
a50937d3747e25f72e6e4d65b15ccb225173081d

SHA256
c1f482103e4d86c1bbdc638e799031a2e24daec06487f913d5102369eab672af

SHA512
8606e34705d0b0b77892465d685b7112c4ebc3f01986fc991f19a3c8ea389c6447806cfea9a0ef08805aaa3bc4e29bd6acf405f132385ad7d327715af4a1c368

Download Submit
memory/2232-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2232-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download