Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11-01-2024 12:25

General

  • Target

    53839921b806cd18c22b174ef7c6ed7b.exe

  • Size

    3.9MB

  • MD5

    53839921b806cd18c22b174ef7c6ed7b

  • SHA1

    ddcdcd9b6cd3ad02875ff8fb14617db7360d2c4e

  • SHA256

    2510bd0349ad32f358f35263ac2698a4c6023e6d84efd356827c058de03692b6

  • SHA512

    8b2a614cac0a4f9fc9a572c660cc5761a1937f49b5c1e4a6c83850a69f6469fd41af96be6b973115d096a73e3912994329a2979d591386da5749280b889d4920

  • SSDEEP

    98304:mnQ9oSH9cakcibiqhlTyx7oXX0/EqcakcibiqhJSLVaRqHxnj9cakcibiqhlTyxo:mQPH9dlirnuqXEMqdlirnSk8Hxnj9dlM

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53839921b806cd18c22b174ef7c6ed7b.exe
    "C:\Users\Admin\AppData\Local\Temp\53839921b806cd18c22b174ef7c6ed7b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\53839921b806cd18c22b174ef7c6ed7b.exe
      C:\Users\Admin\AppData\Local\Temp\53839921b806cd18c22b174ef7c6ed7b.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\53839921b806cd18c22b174ef7c6ed7b.exe" /TN BSpsfata099d /F
        3⤵
        • Creates scheduled task(s)
        PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN BSpsfata099d > C:\Users\Admin\AppData\Local\Temp\qc5HK.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN BSpsfata099d
          4⤵
            PID:2864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\53839921b806cd18c22b174ef7c6ed7b.exe

      Filesize

      3.9MB

      MD5

      c84f4bc70ce36c8e5c4a46c12cb17bea

      SHA1

      1fb3df5af6fd3200c0f922c39ddf01962e11dc3c

      SHA256

      6efb84cfb67c19126ea0f5a72c08da9998f0462db1c1062f747f6f3c5655d36c

      SHA512

      ea849816548d1b2329d1bfd17972df2e98dbd71128cb3e75eee5d052372cfe9087610c23661ef978b703420c02096be29d668b1dcda6f0a733d9e636901feae9

    • C:\Users\Admin\AppData\Local\Temp\qc5HK.xml

      Filesize

      1KB

      MD5

      e87e2abf94ee4cde62ea61cfe1372842

      SHA1

      a529554c471066bd3c10353314c41cdfff1445de

      SHA256

      83580f0bd7e0a5d994ee2a45873b4f160488f8990d08070cd582d5a7d9e24ce4

      SHA512

      7b4950a264dee9f72c4b1ccf7c2252a907b8d4641a443b811079f60ebfb566a045c66dc2406ab18c0ea2cdf615298725837d58ff20cb607b45f01da7eb81e0a1

    • memory/2204-2-0x0000000000220000-0x000000000029E000-memory.dmp

      Filesize

      504KB

    • memory/2204-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2204-16-0x0000000023780000-0x00000000239DC000-memory.dmp

      Filesize

      2.4MB

    • memory/2204-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2204-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2204-53-0x0000000023780000-0x00000000239DC000-memory.dmp

      Filesize

      2.4MB

    • memory/2712-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2712-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2712-27-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/2712-22-0x0000000000380000-0x00000000003FE000-memory.dmp

      Filesize

      504KB

    • memory/2712-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB