Analysis
- max time kernel
141s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/02/2024, 21:56
Behavioral task
behavioral1
Sample
c7aadbe56bb58d121310a54da7ec9766.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
c7aadbe56bb58d121310a54da7ec9766.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target c7aadbe56bb58d121310a54da7ec9766.exe
- Size 76KB
- Sample240229-1ts5lsea96
- SHA256 27427c4976a22f0fb5639a53b6540d39342924b7cdffc8e47218a927a09630ba
- MD5 c7aadbe56bb58d121310a54da7ec9766
- SHA1 30e370a6a5eeb0b08e32b049ad6514fc4b4ce59b
- SHA512 798e92aed4cdda80c097f699d566c841a2a6cee9d6d9345f5878ee7b74f33e1e7234f04d5c1578e19412b15f6df1ed800fd7351c680ba941ec58d11eec0e0a9a
- SSDEEP 1536:f9BgM89fwM5nWiee7aza1hVyKx8QMPfz54u6JHWUll7M6yHEA:f0RfwM5nWuQyVZx8Q0z5102Ull7MU
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4504-0-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000022708-3.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1732-6-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a000000023196-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3292-9-0x0000000010000000-0x000000001001B000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4504-10-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2692-12-0x0000000010000000-0x000000001001B000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3292-13-0x0000000010000000-0x000000001001B000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3292-14-0x0000000010000000-0x000000001001B000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3292-21-0x0000000010000000-0x000000001001B000-memory.dmp INDICATOR_EXE_Packed_ASPack - Blocklisted process makes network request 36 IoCs
flow pid Process 4 3292 rundll32.exe 6 3292 rundll32.exe 9 3292 rundll32.exe 10 3292 rundll32.exe 11 3292 rundll32.exe 37 3292 rundll32.exe 39 3292 rundll32.exe 41 3292 rundll32.exe 42 3292 rundll32.exe 43 3292 rundll32.exe 44 3292 rundll32.exe 45 3292 rundll32.exe 47 3292 rundll32.exe 48 3292 rundll32.exe 49 3292 rundll32.exe 50 3292 rundll32.exe 51 3292 rundll32.exe 65 3292 rundll32.exe 67 3292 rundll32.exe 68 3292 rundll32.exe 69 3292 rundll32.exe 70 3292 rundll32.exe 71 3292 rundll32.exe 72 3292 rundll32.exe 74 3292 rundll32.exe 75 3292 rundll32.exe 76 3292 rundll32.exe 77 3292 rundll32.exe 78 3292 rundll32.exe 81 3292 rundll32.exe 83 3292 rundll32.exe 84 3292 rundll32.exe 85 3292 rundll32.exe 86 3292 rundll32.exe 87 3292 rundll32.exe 88 3292 rundll32.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\usbinckey.sys c7aadbe56bb58d121310a54da7ec9766.exe -
resource yara_rule behavioral2/files/0x0009000000022708-3.dat aspack_v212_v242 behavioral2/files/0x000a000000023196-7.dat aspack_v212_v242 - Deletes itself 1 IoCs
pid Process 2692 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 1732 cardctrl.exe - Loads dropped DLL 2 IoCs
pid Process 3292 rundll32.exe 2692 rundll32.exe - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.222.222 Destination IP 165.87.201.244 Destination IP 208.67.222.222 Destination IP 168.95.192.1 Destination IP 165.87.201.244 Destination IP 209.166.160.36 Destination IP 165.87.201.244 Destination IP 168.95.192.1 Destination IP 209.166.160.36 Destination IP 209.166.160.36 Destination IP 208.67.222.222 Destination IP 168.95.192.1 Destination IP 165.87.201.244 Destination IP 209.166.160.36 Destination IP 165.87.201.244 Destination IP 168.95.192.1 Destination IP 208.67.222.222 Destination IP 168.95.192.1 Destination IP 209.166.160.36 Destination IP 209.166.160.36 Destination IP 168.95.192.1 Destination IP 208.67.222.222 Destination IP 165.87.201.244 Destination IP 208.67.222.222 - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\cardctrl.exe c7aadbe56bb58d121310a54da7ec9766.exe File opened for modification C:\Windows\SysWOW64\cardctrl.exe c7aadbe56bb58d121310a54da7ec9766.exe File created C:\Windows\SysWOW64\usbinckey.dll cardctrl.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4932 ipconfig.exe 448 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4504 c7aadbe56bb58d121310a54da7ec9766.exe 4504 c7aadbe56bb58d121310a54da7ec9766.exe 4504 c7aadbe56bb58d121310a54da7ec9766.exe 4504 c7aadbe56bb58d121310a54da7ec9766.exe 4504 c7aadbe56bb58d121310a54da7ec9766.exe 4504 c7aadbe56bb58d121310a54da7ec9766.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4504 c7aadbe56bb58d121310a54da7ec9766.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4504 wrote to memory of 448 4504 c7aadbe56bb58d121310a54da7ec9766.exe 90 PID 4504 wrote to memory of 448 4504 c7aadbe56bb58d121310a54da7ec9766.exe 90 PID 4504 wrote to memory of 448 4504 c7aadbe56bb58d121310a54da7ec9766.exe 90 PID 1732 wrote to memory of 4932 1732 cardctrl.exe 93 PID 1732 wrote to memory of 4932 1732 cardctrl.exe 93 PID 1732 wrote to memory of 4932 1732 cardctrl.exe 93 PID 1732 wrote to memory of 3292 1732 cardctrl.exe 95 PID 1732 wrote to memory of 3292 1732 cardctrl.exe 95 PID 1732 wrote to memory of 3292 1732 cardctrl.exe 95 PID 4504 wrote to memory of 2692 4504 c7aadbe56bb58d121310a54da7ec9766.exe 96 PID 4504 wrote to memory of 2692 4504 c7aadbe56bb58d121310a54da7ec9766.exe 96 PID 4504 wrote to memory of 2692 4504 c7aadbe56bb58d121310a54da7ec9766.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7aadbe56bb58d121310a54da7ec9766.exe"C:\Users\Admin\AppData\Local\Temp\c7aadbe56bb58d121310a54da7ec9766.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe2⤵
- Gathers network information
PID:448
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\usbinckey.dll,DelInterface C:\Users\Admin\AppData\Local\Temp\c7aadbe56bb58d121310a54da7ec9766.exe2⤵
- Deletes itself
- Loads dropped DLL
PID:2692
-
-
C:\Windows\SysWOW64\cardctrl.exeC:\Windows\SysWOW64\cardctrl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe2⤵
- Gathers network information
PID:4932
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\usbinckey.dll,GetInterface2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cardctrl.exe
- Size 76KB
- SHA256 27427c4976a22f0fb5639a53b6540d39342924b7cdffc8e47218a927a09630ba
- MD5 c7aadbe56bb58d121310a54da7ec9766
- SHA1 30e370a6a5eeb0b08e32b049ad6514fc4b4ce59b
- SHA512 798e92aed4cdda80c097f699d566c841a2a6cee9d6d9345f5878ee7b74f33e1e7234f04d5c1578e19412b15f6df1ed800fd7351c680ba941ec58d11eec0e0a9a
- SSDEEP 1536:f9BgM89fwM5nWiee7aza1hVyKx8QMPfz54u6JHWUll7M6yHEA:f0RfwM5nWuQyVZx8Q0z5102Ull7MU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\usbinckey.dll
- Size 48KB
- SHA256 8a6f7da2a9c3a820d3c6a15315afa9deb8f58d7c2daaeb719ae56d2c94ef96c6
- MD5 fa0670a7dd5dc4410f49b6563b529c25
- SHA1 f8fe88f5c2fbb60187420b49597f8c1e90453fc5
- SHA512 8b17c85ba29a8c667ebf97a2a6ec1cc0f29f959d6dbcc19c2f0bc356d1aaff4a176c05d91864af6deca09627ccf2c461764c09e207983e39d221660e261b4d69
- SSDEEP 768:SdZDJJb5QtnlYHa0c5znCutJ0BY/UAnbhdagDVHrZRkVcshXVnqQs8Bi2ZHaHw7u:SdhJJ1ElYrc5zCuMBY/rnbigDJZeikL9
- MD5 SHA1 SHA512 SSDEEP