2422622df120f18f5eba7df528358de6cdf520ec6609c1257852b34fe5a3588f

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DBF2XML.exe
Size

463KB
MD5

bfd68a8a88eb4c0a7cd3fb2788631990
SHA1

f6f1430cfc7470b9a0f90e5c3b49415ebcd685f9
SHA256

30ddd192404375b665a6c8a00d2a0351d886a655d35c27bc4f5662406ad7f13c
SHA512

dc618add1be08f93f7e26faf1a7caca1147b732b6b94c61dafdd5c1987b487d391f4ac879a8bd969b161654f41d03a0c58fbd4a0ab68cf1b99f1c444dc6bc540
SSDEEP

12288:VBA6shwWiauONjicfqY9ZJFJK5agXolUL:VlaxvfqwZJFJOaIPL

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2136	DBF2XML.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000400000-0x0000000000441000-memory.dmp	upx
behavioral1/memory/2136-33-0x0000000000400000-0x0000000000441000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2136	DBF2XML.exe

C:\Users\Admin\AppData\Local\Temp\DBF2XML.exe
"C:\Users\Admin\AppData\Local\Temp\DBF2XML.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\1E253D04\Enu.lng

Filesize
4KB

MD5
4e8bd054ec46c7f549168bcee23352a0

SHA1
bef2dd28ad930f82f0db7ea82db53cb486f6f6f0

SHA256
b002be66ead0eae34971c6455bf1baa87aacabaf6f84a6aaf9b0ad9cf6c1da8a

SHA512
6a95f11a131397090ffc69a7096fadf6d11691f3c86fe716c3067cadb93ae8cb711127a1e7044bf1c8a5bb1852e55babd64726f08b0ee6a7cc05504bdcf91592

Download Submit
C:\Temp\1E253D04\gins.ini

Filesize
1002B

MD5
07b01844e043ec45dd644a90a8f1cea6

SHA1
5bc4135cdac6da3b266a3f9e14f1fe4fa2a0d423

SHA256
4a953f11e94d7528a42b8818783edcd0702b4d94503da89586892ef58d29f18c

SHA512
51edae9fe5ec730033f7ed3c3efb85f84fe6f36514d2cc68c91ebf26ef7c1e609cfb04917ff80c13706ccc41e90aa1a57b0521af9a1138cc24d02f38f676c527

Download Submit
\Temp\1E253D04\unpack.dll

Filesize
33KB

MD5
d24d7a465eb76a291aa3301814904391

SHA1
5268924f4d7b2f3dad9fb34f62a867934b3c55c8

SHA256
f02c3d1fe34a0759592cbb4fa39ee97b962b34045271d826a3a53b2a81c3cef7

SHA512
336569262b2166c1839c4f06bc222b44ee5e96a70a080b3e6615593254f84aaaa1b67fccfe0b21bd74b387da3e1d62c51bb1013ece6aadc9f97fd913c1724556

Download Submit
memory/2136-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2136-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download