bb51c5c28fef4299f4cf62b077d35482e50e14dfff1a64ec20e997673b546dac

Analysis

max time kernel
165s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2491890411459f9d6b99fedfa5ad6bbd.exe
Size

1.8MB
MD5

2491890411459f9d6b99fedfa5ad6bbd
SHA1

29df6a351913d871590ff6c932d945040e4cf7ce
SHA256

bb51c5c28fef4299f4cf62b077d35482e50e14dfff1a64ec20e997673b546dac
SHA512

110951a281c6fa43d65fe9a9bd1b119d1e551f6b3ccfd6af39a5fe448dff31d014ce342faa6cd4708715cce47e152b5384c5ea28f500d629a70344c039506f0e
SSDEEP

24576:S6pQPxQ2JyP2r5mJV91xM7RpbwgIvs7Nxq7:SCqm2Jpr0nNM7Dus7NxG

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4040-0-0x0000000000400000-0x00000000005BA000-memory.dmp	upx
behavioral2/files/0x00020000000227a8-5.dat	upx
behavioral2/memory/4040-500-0x0000000000400000-0x00000000005BA000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsound.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jmc.txt	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\release.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\EnableDisconnect.emf.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	2491890411459f9d6b99fedfa5ad6bbd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui	2491890411459f9d6b99fedfa5ad6bbd.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	2491890411459f9d6b99fedfa5ad6bbd.exe

C:\Users\Admin\AppData\Local\Temp\2491890411459f9d6b99fedfa5ad6bbd.exe
"C:\Users\Admin\AppData\Local\Temp\2491890411459f9d6b99fedfa5ad6bbd.exe"
1⤵
- Drops file in Program Files directory
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
1.3MB

MD5
d064db2bd5a01676b862567ce1108460

SHA1
f1efc38c14692b135a238eb56cac9eb7e2b4a7d9

SHA256
8f86d8b57305ea561384239e8bf19dfe788a94187ddbd69cf34989c0db86e51c

SHA512
985a68abadb16e314aee92e73792c1eabea3b3e08663040755888ecbd9b6a870d771da5f4b32a3bcda78eb2ecceb95e70f0cf9c3b7b02ad94ca73bbd631997d4

Download Submit
memory/4040-0-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/4040-500-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads