89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce

General

Target

89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe
Size

830KB
MD5

3687bb7fe542d93e99ea7e3ad8e8578f
SHA1

e47ad71fd0d891c22bfe0af3a3a440767a3f2e5f
SHA256

89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce
SHA512

1d4903e65f0ff19adfd2d5162677428b3cc4d3e4fe4fe6561957df97f018d5c8acae2225ffb74eb4e22baeec5a578e95ab3580514778bf3a4bb425ae910f2f2e
SSDEEP

12288:ZEmC92VnpahSR7BwkASR49lkQHMIWnDp2f47z4PUUhyVb4yDKUgM03qcmT1Pd2Kh:ZEF96C6BwkP2lsl8fEQemdM03zmT1Pf

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1676-0-0x0000000000EB0000-0x0000000000FEC000-memory.dmp	upx
behavioral1/memory/1676-22-0x0000000000EB0000-0x0000000000FEC000-memory.dmp	upx
behavioral1/memory/1676-30-0x0000000000EB0000-0x0000000000FEC000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsShell81325.log	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe
File opened for modification	C:\Windows\WindowSystemNewUpdate221.log	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2196	2880	WerFault.exe	28
2972	2760	WerFault.exe	30

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe
Token: SeDebugPrivilege	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe
Token: SeIncBasePriorityPrivilege	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 1676 wrote to memory of 2880	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	28
PID 2880 wrote to memory of 2196	2880	rasphone.exe	29
PID 2880 wrote to memory of 2196	2880	rasphone.exe	29
PID 2880 wrote to memory of 2196	2880	rasphone.exe	29
PID 2880 wrote to memory of 2196	2880	rasphone.exe	29
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 1676 wrote to memory of 2760	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	30
PID 2760 wrote to memory of 2972	2760	relog.exe	32
PID 2760 wrote to memory of 2972	2760	relog.exe	32
PID 2760 wrote to memory of 2972	2760	relog.exe	32
PID 2760 wrote to memory of 2972	2760	relog.exe	32
PID 1676 wrote to memory of 2564	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	34
PID 1676 wrote to memory of 2564	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	34
PID 1676 wrote to memory of 2564	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	34
PID 1676 wrote to memory of 2564	1676	89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe	34

C:\Users\Admin\AppData\Local\Temp\89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe
"C:\Users\Admin\AppData\Local\Temp\89109ea12eea77fea65532fb4a4f137c9db6ef143d7e72db5abdfe23dabdd7ce.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rasphone.exe
  "C:\Windows\SysWOW64\rasphone.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 96
    3⤵
    - Program crash
    PID:2196
- C:\Windows\SysWOW64\relog.exe
  "C:\Windows\SysWOW64\relog.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 176
    3⤵
    - Program crash
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\89109E~1.EXE > nul
  2⤵
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-25-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-28-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-47-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-34-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-30-0x0000000000EB0000-0x0000000000FEC000-memory.dmp

Filesize
1.2MB

Download
memory/1676-26-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-23-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-22-0x0000000000EB0000-0x0000000000FEC000-memory.dmp

Filesize
1.2MB

Download
memory/1676-14-0x0000000010000000-0x00000000100FD000-memory.dmp

Filesize
1012KB

Download
memory/1676-0-0x0000000000EB0000-0x0000000000FEC000-memory.dmp

Filesize
1.2MB

Download
memory/2760-12-0x0000000000080000-0x000000000018D000-memory.dmp

Filesize
1.1MB

Download
memory/2880-2-0x0000000000190000-0x000000000029D000-memory.dmp

Filesize
1.1MB

Download
memory/2880-6-0x0000000000190000-0x000000000029D000-memory.dmp

Filesize
1.1MB

Download
memory/2880-4-0x0000000000190000-0x000000000029D000-memory.dmp

Filesize
1.1MB

Download
memory/2880-3-0x0000000000190000-0x000000000029D000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing