abc1fb687fc4e65f2b791923cb76dab88067c0e1e115cdf97b41a97ee3e5a8b0

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0857f2c8541dba287d648eec17163d3f.exe
Size

289KB
MD5

0857f2c8541dba287d648eec17163d3f
SHA1

8ed85dfd683be2919a1b612d1d924720d962d0a0
SHA256

abc1fb687fc4e65f2b791923cb76dab88067c0e1e115cdf97b41a97ee3e5a8b0
SHA512

f83957775fd9a2f840d0e50d8ca36c92209a6cf989adfca866b043281f05825de5bb0079c535d346e6aa2e629772bdd45148ef02b81026bac97e6248271888f1
SSDEEP

6144:5NENowLmN7JVb3hwwDX+l5F7l1k5u8vk3U4pT+PhrWHoS:5RvNdV7rDX+zF7lquQaYh6HoS

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2792	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2868	RemoteAbc.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-0-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral1/files/0x000c000000012267-3.dat	upx
behavioral1/memory/2868-4-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral1/memory/2012-15-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral1/memory/1108-14-0x0000000000400000-0x0000000000493000-memory.dmp	upx
behavioral1/files/0x000c000000012267-6.dat	upx
behavioral1/memory/2868-17-0x0000000000400000-0x0000000000493000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 1108	2868	RemoteAbc.exe	31

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\system32R_Server\RemoteAbc.exe	0857f2c8541dba287d648eec17163d3f.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1108	2868	RemoteAbc.exe	31
PID 2868 wrote to memory of 1108	2868	RemoteAbc.exe	31
PID 2868 wrote to memory of 1108	2868	RemoteAbc.exe	31
PID 2868 wrote to memory of 1108	2868	RemoteAbc.exe	31
PID 2868 wrote to memory of 1108	2868	RemoteAbc.exe	31
PID 2868 wrote to memory of 1108	2868	RemoteAbc.exe	31
PID 2012 wrote to memory of 2792	2012	0857f2c8541dba287d648eec17163d3f.exe	29
PID 2012 wrote to memory of 2792	2012	0857f2c8541dba287d648eec17163d3f.exe	29
PID 2012 wrote to memory of 2792	2012	0857f2c8541dba287d648eec17163d3f.exe	29
PID 2012 wrote to memory of 2792	2012	0857f2c8541dba287d648eec17163d3f.exe	29

C:\Users\Admin\AppData\Local\Temp\0857f2c8541dba287d648eec17163d3f.exe
"C:\Users\Admin\AppData\Local\Temp\0857f2c8541dba287d648eec17163d3f.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\649635.bat
  2⤵
  - Deletes itself
  PID:2792

C:\Program Files (x86)\system32R_Server\RemoteAbc.exe
"C:\Program Files (x86)\system32R_Server\RemoteAbc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" 73471
  2⤵
  PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\system32R_Server\RemoteAbc.exe

Filesize
289KB

MD5
0857f2c8541dba287d648eec17163d3f

SHA1
8ed85dfd683be2919a1b612d1d924720d962d0a0

SHA256
abc1fb687fc4e65f2b791923cb76dab88067c0e1e115cdf97b41a97ee3e5a8b0

SHA512
f83957775fd9a2f840d0e50d8ca36c92209a6cf989adfca866b043281f05825de5bb0079c535d346e6aa2e629772bdd45148ef02b81026bac97e6248271888f1

Download Submit
C:\Program Files (x86)\system32R_Server\RemoteAbc.exe

Filesize
231KB

MD5
985ceaea838a88ecc884794362e915c5

SHA1
f283c1050b4127c4c9d1bab76567ca6942fad160

SHA256
ee5d7d9bb03ac254a46b0e439d2ae103a8a523e419f57b7ae23982ac3d766eaf

SHA512
91db01c3ab0ddb49805614e423fba0517b7ce2c28534ca279b0120eebd0904dcfacc3dc1744499ccad98e366330baaa71d86c0c52679e3862b5485f8ff05b315

Download Submit
C:\Users\Admin\AppData\Local\Temp\649635.bat

Filesize
190B

MD5
de1dd20d65a9e191d091186ea14610e0

SHA1
a25e86664e228a1ed7ae0407251657c0ff47c470

SHA256
1bb0aa6203e5313a68afb17dce845e7ed4e7ff1d49c6dce54f78cdfad69baf2e

SHA512
b5be57b89ffe23bde89f087eac738ad3e017df73a0d470238ee23f635efd13eea42302bb74387d58484ad6fe45aef6bf1433d41c40dc565972a10013aac5ffb0

Download Submit
memory/1108-14-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2012-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2012-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2012-15-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2868-4-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2868-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2868-17-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download