c8db874f0f3c3e1765c13a118cc151221173cc721530ef84839ed2fcdaac1f0a

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bed362ca73c31972f31525c6a26a821.exe
Size

14KB
MD5

4bed362ca73c31972f31525c6a26a821
SHA1

05ab81f4d826286c21adeb3159fe28eea130119b
SHA256

c8db874f0f3c3e1765c13a118cc151221173cc721530ef84839ed2fcdaac1f0a
SHA512

3f915faa00523affc644ab9c91fc32c2ddc4686d28cc01345f06b907ab0c82939515a141c73b40fea560c834106005ed395199303a0dbf59300eeedf3be00e9e
SSDEEP

384:nnE+BJZLti8TwAM9FrbQ4Y06bkJUVcgnUsDmnB2n4:nEGZBjwAMPA4Y06cgUsQQn

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
2648	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3036	lenschk.exe

Loads dropped DLL 2 IoCs

pid	Process
2968	4bed362ca73c31972f31525c6a26a821.exe
2968	4bed362ca73c31972f31525c6a26a821.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/files/0x0010000000012251-3.dat	upx
behavioral1/memory/3036-11-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2968-12-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lensch.dll	4bed362ca73c31972f31525c6a26a821.exe
File created	C:\Windows\SysWOW64\lenschk.exe	4bed362ca73c31972f31525c6a26a821.exe
File opened for modification	C:\Windows\SysWOW64\lenschk.exe	4bed362ca73c31972f31525c6a26a821.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3036	2968	4bed362ca73c31972f31525c6a26a821.exe	28
PID 2968 wrote to memory of 3036	2968	4bed362ca73c31972f31525c6a26a821.exe	28
PID 2968 wrote to memory of 3036	2968	4bed362ca73c31972f31525c6a26a821.exe	28
PID 2968 wrote to memory of 3036	2968	4bed362ca73c31972f31525c6a26a821.exe	28
PID 2968 wrote to memory of 2648	2968	4bed362ca73c31972f31525c6a26a821.exe	31
PID 2968 wrote to memory of 2648	2968	4bed362ca73c31972f31525c6a26a821.exe	31
PID 2968 wrote to memory of 2648	2968	4bed362ca73c31972f31525c6a26a821.exe	31
PID 2968 wrote to memory of 2648	2968	4bed362ca73c31972f31525c6a26a821.exe	31

C:\Users\Admin\AppData\Local\Temp\4bed362ca73c31972f31525c6a26a821.exe
"C:\Users\Admin\AppData\Local\Temp\4bed362ca73c31972f31525c6a26a821.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\lenschk.exe
  C:\Windows\system32\lenschk.exe ˜‰
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\4bed362ca73c31972f31525c6a26a821.exe.bat
  2⤵
  - Deletes itself
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4bed362ca73c31972f31525c6a26a821.exe.bat

Filesize
182B

MD5
c5d75d9565272cf9f3667050b5e9e006

SHA1
db00b197718a434d7cd4e24d1a5bf4847766d909

SHA256
c52eb5f29a0b37b8ee911f33dfafa21478db5a9d3a2eeb569a0255d261d49567

SHA512
390124af24d751cb20a18879cce54e18fdcc5bc12cbed6b7b924e5658d7e8033edbb17d4f5b5727c4d18629310f0cf81a7535a25f938135ba83656f216ad98b7

Download Submit
\Windows\SysWOW64\lenschk.exe

Filesize
14KB

MD5
4bed362ca73c31972f31525c6a26a821

SHA1
05ab81f4d826286c21adeb3159fe28eea130119b

SHA256
c8db874f0f3c3e1765c13a118cc151221173cc721530ef84839ed2fcdaac1f0a

SHA512
3f915faa00523affc644ab9c91fc32c2ddc4686d28cc01345f06b907ab0c82939515a141c73b40fea560c834106005ed395199303a0dbf59300eeedf3be00e9e

Download Submit
memory/2968-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2968-10-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/2968-12-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2968-16-0x0000000000230000-0x000000000023F000-memory.dmp

Filesize
60KB

Download
memory/3036-11-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download