Resubmissions
09/04/2024, 10:06
240409-l5bmdacc75 709/04/2024, 10:05
240409-l4pgvacc66 709/04/2024, 10:05
240409-l4nwbacc65 1009/04/2024, 10:05
240409-l4m9safe9x 1029/01/2024, 04:54
240129-fjkehaaec3 8Analysis
-
max time kernel
75s -
max time network
303s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29/01/2024, 04:54
General
-
Target
8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91.exe
-
Size
1.9MB
-
MD5
d5057eda9b4251e0e52fb2d8524cfa57
-
SHA1
327f6d72563fdfb1ab206ac9a3b2d4c770d066f5
-
SHA256
8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91
-
SHA512
24d423aa3d71b12af016c5918940d4984f1640f902dc36adc9a29dd9980baa2210ea250111b052dc9fdc5cdfbea8ece8813494f2d2ccecefa60f224a3d731fb2
-
SSDEEP
24576:OPUnujryKC12iAlGaRctykklEPjJ3QIzs6yBKSolGIUOVPgJAt8EnZapKtpMh6co:9Dr2iAcKcC+N3Bs6ywSz5SSAza88hqx
Malware Config
Signatures
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91.exe"C:\Users\Admin\AppData\Local\Temp\8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91.exe"C:\Users\Admin\AppData\Local\Temp\8a531865aa5785bb7b20574bb347744a5d83cf8719c6809217402b4fa5fbde91.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /D /T1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD51c5d1f1974bb5fd5a986dfb699dfa5ba
SHA1bb3734338b138157484713c2a2f4f4e1b1aeaed2
SHA25683ef30ee1a0c8b1cbf4630c4263bda4c0048ff78babc990260fd4191cd915fad
SHA512fd012d6a4e1a9fbb895b88c4b8974ffb8a2b80c9afe446d5d2552dadbe37023e75378c718c59cc70df1e2a30acacdcf0c51d60a53a6c57b671e25752517250e6
-
Filesize
15.4MB
MD50f07a232845c03c0734e3673b7072d04
SHA1f44d3eeb7494ab2742b1d561564f7bc4677ac8c7
SHA256d2cb54f863da4072779a479444e2e2cd34069184091b2dd9011b5ae1c6a23c4e
SHA512a244650abe707ad9857370c0331279ec43d0253399dcf33a5b9fe5f61b7558082f3e25f1816f4e44e640abd5afebf6e3df9257362cdb7605210c537105cebe52
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4.3MB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB