Analysis

  • max time kernel
    240s
  • max time network
    282s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 04:27

General

  • Target

    Slurp 15.06 AutoUpdater!/SLURP.exe

  • Size

    6.4MB

  • MD5

    0faf0894e56231768611e1376a19d043

  • SHA1

    ba413d5903e5e63f9cfc71889644e7e3d3644edd

  • SHA256

    364bb4787e4eb929266c2a8acecfbd29117df87732670ed47716e5ee84beda1a

  • SHA512

    c10af3aee120ce0b42ad9b930f54b5392ff1c6771a5f1ebed06c300fadb8d9fc2aa8b05b42903ba40931c59b2aec9181ffcd6918c57edebc68efb7b46b163b39

  • SSDEEP

    196608:oWYdxfa/NAKQAt2tpMYaSaoCYcHH87CouJRn5du9:GXf0npoMPSaoMouJRnv

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Slurp 15.06 AutoUpdater!\SLURP.exe
    "C:\Users\Admin\AppData\Local\Temp\Slurp 15.06 AutoUpdater!\SLURP.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\Slurp 15.06 AutoUpdater!\SlurpBootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\Slurp 15.06 AutoUpdater!\SlurpBootstrapper.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 900
        3⤵
        • Program crash
        PID:1500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab210A.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar2A6F.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1064-4-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/1064-44-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/1064-0-0x0000000074C90000-0x000000007537E000-memory.dmp

    Filesize

    6.9MB

  • memory/1064-5-0x0000000000440000-0x0000000000482000-memory.dmp

    Filesize

    264KB

  • memory/1064-6-0x0000000000B00000-0x0000000000B40000-memory.dmp

    Filesize

    256KB

  • memory/1064-2-0x0000000009570000-0x000000000A126000-memory.dmp

    Filesize

    11.7MB

  • memory/1064-1-0x0000000000BC0000-0x000000000122A000-memory.dmp

    Filesize

    6.4MB

  • memory/1064-3-0x0000000074C90000-0x000000007537E000-memory.dmp

    Filesize

    6.9MB

  • memory/1064-43-0x0000000074C90000-0x000000007537E000-memory.dmp

    Filesize

    6.9MB

  • memory/3032-45-0x0000000074C90000-0x000000007537E000-memory.dmp

    Filesize

    6.9MB

  • memory/3032-41-0x00000000012D0000-0x00000000012D8000-memory.dmp

    Filesize

    32KB

  • memory/3032-42-0x0000000000AD0000-0x0000000000B7A000-memory.dmp

    Filesize

    680KB

  • memory/3032-46-0x0000000000560000-0x00000000005A0000-memory.dmp

    Filesize

    256KB

  • memory/3032-47-0x0000000074C90000-0x000000007537E000-memory.dmp

    Filesize

    6.9MB

  • memory/3032-48-0x0000000000560000-0x00000000005A0000-memory.dmp

    Filesize

    256KB