79f8d2bd26c4c2ad8ecdb3414c1372245fcbeaba1fbd8dd7343836108c6cf565

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:49

Target

2526b416ae90b52e27ae965bd8b564f0.exe
Size

72KB
MD5

2526b416ae90b52e27ae965bd8b564f0
SHA1

92414892e991585241132c0d3291fabef2c1fe99
SHA256

79f8d2bd26c4c2ad8ecdb3414c1372245fcbeaba1fbd8dd7343836108c6cf565
SHA512

0cefa126e3a9ca783ec52e84364589ca79ecb206e480fbe8cd7a468a487f5f02dcb3e3c56066f61e5dccf809b6d69b10cf4e5fe044bb2abae6e411651dfde7e9
SSDEEP

1536:Wze1L9ihxoI+rtyWASIC4qrFfpFF60a8U3/HN1t8rn7IPCFiR3fsk6+/vmjof:WzXhxoI+rty+IjqrLa8UvNzLPjfsXo

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
1408	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1700-1-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/1700-3-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1700	2526b416ae90b52e27ae965bd8b564f0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1408	1700	2526b416ae90b52e27ae965bd8b564f0.exe	29
PID 1700 wrote to memory of 1408	1700	2526b416ae90b52e27ae965bd8b564f0.exe	29
PID 1700 wrote to memory of 1408	1700	2526b416ae90b52e27ae965bd8b564f0.exe	29
PID 1700 wrote to memory of 1408	1700	2526b416ae90b52e27ae965bd8b564f0.exe	29

C:\Users\Admin\AppData\Local\Temp\2526b416ae90b52e27ae965bd8b564f0.exe
"C:\Users\Admin\AppData\Local\Temp\2526b416ae90b52e27ae965bd8b564f0.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Olb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1408

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1700-0-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1700-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1700-4-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1700-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download