ad2f32b48a9fddbc27530fa627d4c344597dd7555d96e61a9fd881bc2218cc13

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d8a0d45b54fca5094dcbe4d6033f126.exe
Size

35KB
MD5

4d8a0d45b54fca5094dcbe4d6033f126
SHA1

9f4ebefe7e06a1063b0fa5a0b9fa1ccef77b1486
SHA256

ad2f32b48a9fddbc27530fa627d4c344597dd7555d96e61a9fd881bc2218cc13
SHA512

a0f6bed3cf03210116ff9c9cb750dd403975c1d8919c37ee10d8f4c4e53c67a837d13185a813680240bb8075ee043e3895ae994000e631a26b92112e77073ff2
SSDEEP

768:nynDf82zldMZg8rn3unW9Oc+1ftPa/c3Iy+gaf3ZxUN:cg2huZg+n+JH1ftPlItvY

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	AqAaN5eu.exe

Loads dropped DLL 2 IoCs

pid	Process
2440	4d8a0d45b54fca5094dcbe4d6033f126.exe
2440	4d8a0d45b54fca5094dcbe4d6033f126.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2440-2-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/files/0x000b000000012242-7.dat	upx
behavioral1/memory/2440-8-0x00000000023B0000-0x00000000023C6000-memory.dmp	upx
behavioral1/memory/2664-17-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2664-19-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AqAaN5eu.exe	4d8a0d45b54fca5094dcbe4d6033f126.exe
File opened for modification	C:\Windows\SysWOW64\AqAaN5eu.exe	4d8a0d45b54fca5094dcbe4d6033f126.exe
File created	C:\Windows\SysWOW64\AqAaN5eu.exe.a_a	AqAaN5eu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2664	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	29
PID 2440 wrote to memory of 2664	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	29
PID 2440 wrote to memory of 2664	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	29
PID 2440 wrote to memory of 2664	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	29
PID 2440 wrote to memory of 2580	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	30
PID 2440 wrote to memory of 2580	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	30
PID 2440 wrote to memory of 2580	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	30
PID 2440 wrote to memory of 2580	2440	4d8a0d45b54fca5094dcbe4d6033f126.exe	30

C:\Users\Admin\AppData\Local\Temp\4d8a0d45b54fca5094dcbe4d6033f126.exe
"C:\Users\Admin\AppData\Local\Temp\4d8a0d45b54fca5094dcbe4d6033f126.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\AqAaN5eu.exe
  "C:\Windows\system32\AqAaN5eu.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\4D8A0D~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\AqAaN5eu.exe

Filesize
35KB

MD5
4d8a0d45b54fca5094dcbe4d6033f126

SHA1
9f4ebefe7e06a1063b0fa5a0b9fa1ccef77b1486

SHA256
ad2f32b48a9fddbc27530fa627d4c344597dd7555d96e61a9fd881bc2218cc13

SHA512
a0f6bed3cf03210116ff9c9cb750dd403975c1d8919c37ee10d8f4c4e53c67a837d13185a813680240bb8075ee043e3895ae994000e631a26b92112e77073ff2

Download Submit
memory/2440-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2440-2-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2440-8-0x00000000023B0000-0x00000000023C6000-memory.dmp

Filesize
88KB

Download
memory/2440-15-0x00000000023B0000-0x00000000023C6000-memory.dmp

Filesize
88KB

Download
memory/2664-17-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2664-19-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download