Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 14:09
Behavioral task
behavioral1
Sample
53b8c0b31af3ba5de658c119e39f73bc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
53b8c0b31af3ba5de658c119e39f73bc.exe
Resource
win10v2004-20231215-en
General
-
Target
53b8c0b31af3ba5de658c119e39f73bc.exe
-
Size
585KB
-
MD5
53b8c0b31af3ba5de658c119e39f73bc
-
SHA1
946d13ae1bcc275b3b1e3542b08f04803a93b50a
-
SHA256
4311e97e616734f94d1aa4d38f37679749ae84513d132aee134fbc364d25b6ec
-
SHA512
a2963aeca88f486c519fec957878616182c62ff7fb5f2fda36816678594a4b54192abe56088666328142ddef7479621222de66c5e74a52f69f9756463e417436
-
SSDEEP
12288:WXe9PPlowWX0t6mOQwg1Qd15CcYk0We10dOi0I9xkhHnSumVWvc/dNNcEUKc:rhloDX0XOf4pI9mhHisENWj
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1756-0-0x0000000000400000-0x0000000000554000-memory.dmp upx behavioral2/memory/1756-10-0x0000000000400000-0x0000000000554000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1756-10-0x0000000000400000-0x0000000000554000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2616 1756 WerFault.exe 53b8c0b31af3ba5de658c119e39f73bc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
53b8c0b31af3ba5de658c119e39f73bc.exedescription pid process target process PID 1756 wrote to memory of 1172 1756 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe PID 1756 wrote to memory of 1172 1756 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe PID 1756 wrote to memory of 1172 1756 53b8c0b31af3ba5de658c119e39f73bc.exe 53b8c0b31af3ba5de658c119e39f73bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"C:\Users\Admin\AppData\Local\Temp\53b8c0b31af3ba5de658c119e39f73bc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1756 -ip 17561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut4239.tmpFilesize
216KB
MD50fe362b1c6d19ce9a16a63a18b31235c
SHA100201f7b6d9b2d1f7b0c05ff2ff64b041bb80dda
SHA25601d97f5906f0ddb907de1e6d72358977c524fa4c49e847d22a6a3be3e4438ce8
SHA5123c2ee0179f6a198f9b7eb88f0753eb70911f90e6291328a0c431122c84dfb02e0c2f122c5a16ac8dfbb6526dd6595e0e392db7791f25e3dd565455915f0d9aff
-
memory/1756-0-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1756-8-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/1756-9-0x0000000000C30000-0x0000000000C32000-memory.dmpFilesize
8KB
-
memory/1756-10-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB