Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 11:46

General

  • Target

    4e37c3ae5dbf6894974355d260f3f5ec.exe

  • Size

    765KB

  • MD5

    4e37c3ae5dbf6894974355d260f3f5ec

  • SHA1

    255d3578c30956752872e62aec1143c72e6b8f3c

  • SHA256

    6eb47f0ba97758b106cd8c33204491a38bf99758c297898d712defd91054b055

  • SHA512

    8ef1d85091786bd3fe16b14f06b73514f2048b5c299a714ab525d8eb5548bd7e8fbbccf656469141ee52961a73498b89f28576a8140b6e8179a6aae8311fb811

  • SSDEEP

    12288:wmclQvlezdIU5FPq/xuI9IH1+GkylWbeBersBvhXBOeVK7+ZflO9dJ5IECpxOok3:TlvEdt8Z1+9kycagr8ZBxDcjukL2Y

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe
    "C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe
      C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe" /TN U5Z8sQiHf24d /F
        3⤵
        • Creates scheduled task(s)
        PID:2812
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN U5Z8sQiHf24d > C:\Users\Admin\AppData\Local\Temp\BUr1Fp1vF.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2980
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Query /XML /TN U5Z8sQiHf24d
    1⤵
      PID:2728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe

      Filesize

      765KB

      MD5

      bb69d74f3b324c9cacf894fed0e9e3f4

      SHA1

      07dce2dc6b233a600360862719e348dcadd54ca4

      SHA256

      ce131081adfd562ec14e66dbab6a1c608b943f87d2fe0039a3ae18525d19d7b4

      SHA512

      062315b1f05d40dd2d1ab33bd9044fec542ae822029dbfc070dbc7728b2f3ea9488ba577758aab2a58a6fcdbb6a754da9424725cae5d7e3f21d2e7a5e0c93c01

    • \Users\Admin\AppData\Local\Temp\4e37c3ae5dbf6894974355d260f3f5ec.exe

      Filesize

      382KB

      MD5

      c0d69aa15607658340ed86b6656f638d

      SHA1

      3fb5e8f8880cc92562582dfdbbeda8cf75c696ec

      SHA256

      f381405e4e2d0ff2d7ab7552fd3a48b385eeb4aafbe3c2534b7ceafd6167e0a4

      SHA512

      8399d386f9c407bc73fdcb5fca874db7dd8cd32af0040a73466ab3eec8aa7dcede19fbd4e1906ed1e9aa2eec4218ea88de7c3f93acadd5a4f3b021afdc1da3d1

    • memory/1716-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1716-17-0x0000000023060000-0x00000000232BC000-memory.dmp

      Filesize

      2.4MB

    • memory/1716-3-0x00000000001A0000-0x000000000021E000-memory.dmp

      Filesize

      504KB

    • memory/1716-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1716-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2872-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2872-31-0x0000000000280000-0x00000000002EB000-memory.dmp

      Filesize

      428KB

    • memory/2872-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2872-22-0x0000000022D90000-0x0000000022E0E000-memory.dmp

      Filesize

      504KB

    • memory/2872-53-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB