9b16a768a855dac850fcc3420dd0e13a5508f1c94f408ccdd13820ee914a33fc

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.exe
Size 370KB
Sample240229-1mxt8adh45
SHA256 9638581a59653c0d6f01110be90cfaf13b15ab91b3839ee9d46dce33f26e6a2b
MD5 633b2db9da9af8ce7f6c14acbd24770a
SHA1 7c6d4fc0cddb0213fc98421167f75e5d7afe27fe
SHA512 fac63132db6d52d55c10618dac00f3b4ffe7cc1ddc5284dd90da5e24f447366273aea7712590ab36a2f243535e7c095c4b29bef9f6ba54db4b3993ee55a52172
SSDEEP 3072:zXjoutudpVpg4fq0SjJpyHwwwkrqxGrDgaghZuRaaaPaAtzVSR+5MCG:zXjoSEVC4fq0QWBrrDz3WtzVSA5MC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2872	b2e.exe

Loads dropped DLL 2 IoCs

pid	Process
2304	run.exe
2304	run.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2304-0-0x0000000000400000-0x00000000004BF000-memory.dmp	upx
behavioral3/memory/2304-9-0x0000000000400000-0x00000000004BF000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2872	2304	run.exe	28
PID 2304 wrote to memory of 2872	2304	run.exe	28
PID 2304 wrote to memory of 2872	2304	run.exe	28
PID 2304 wrote to memory of 2872	2304	run.exe	28
PID 2872 wrote to memory of 2564	2872	b2e.exe	29
PID 2872 wrote to memory of 2564	2872	b2e.exe	29
PID 2872 wrote to memory of 2564	2872	b2e.exe	29
PID 2872 wrote to memory of 2564	2872	b2e.exe	29
PID 2872 wrote to memory of 2448	2872	b2e.exe	31
PID 2872 wrote to memory of 2448	2872	b2e.exe	31
PID 2872 wrote to memory of 2448	2872	b2e.exe	31
PID 2872 wrote to memory of 2448	2872	b2e.exe	31

C:\Users\Admin\AppData\Local\Temp\run.exe
"C:\Users\Admin\AppData\Local\Temp\run.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\8D13.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\8D13.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\8D13.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\run.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\8E7A.tmp\batfile.bat" "
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

batfile.bat

Path C:\Users\Admin\AppData\Local\Temp\8E7A.tmp\batfile.bat
Size 158B
SHA256 52ca6a8fe69ab59ca99b72500f5a9baadbe277ca0dea6dd8462acb322678a146
MD5 2ebd35710cdf46a6bfc1b7a9a573e991
SHA1 c52403395a0b51b50cd550e97d8cc260605bc873
SHA512 d2907d3fe5c3c44f8fb08e233671a9cf268f647e9cd7780c46b3db7afe74b5c59a410ac4993dd5e5a928b6dc5e95d31e6bebc34e1bf9746b6dab6283d798ea8f
MD5 SHA1 SHA512

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 a93f5643ffd049a5a2358e805291601689a10fd4e36f1fa47774972ae7d926c3
MD5 ed594f5a5a0882e751ccbdc3da81b708
SHA1 97c6cef06f6f3fdaefbb9460cc49174e5935b9b6
SHA512 5e49ac6158eb9cb4ce9f865129cdfd008412d7232876cfac8c7dfadd5e0c251f3ca771147f6c2400373f61df031d8c068756fdcbf1732c6f44dc3442ef61b425
MD5 SHA1 SHA512

Submit Download

b2e.exe

Path \Users\Admin\AppData\Local\Temp\8D13.tmp\b2e.exe
Size 8KB
SHA256 82b620227e2ff4eecdc396367ef3cd090db387d5fa9c28be98296892acbe0952
MD5 b59836f8bce4b7a9c5c44bd3d77bbc05
SHA1 deef3c038817d8af51ebae1c9b547bdeafe90500
SHA512 ba329fecfd4367fdc26b9daa3974e62d27b4763d850f182246ad2f27f8dcb445ec803b576d617d93881d774f2b19a437fef0909c8a637ec9fc2b3380113095d6
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcf:3R5Fhp8cdwpHR3AkPLiM79mLU2Pcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2304-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2304-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Download

memory/2872-13-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2872-36-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads