Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 07:24

General

  • Target

    HEUR-Trojan.Win32.Agent.exe

  • Size

    205KB

  • MD5

    00865701d63e7cfb69ec05f5af2243ae

  • SHA1

    f05431c81b908601c48ad6e2582b4cff280e97e2

  • SHA256

    c80800ba815c9a0d125222656af33c1028691da1be6988985cbb18dc806660fe

  • SHA512

    378a8e69870d8a10d3781acb820592ef11e56eb6e42ef15d087a4fc0261968d56be08564a11700cb79839700af643f6e136e3a5140189ba0811b8f364ed27354

  • SSDEEP

    6144:y8LuYnRrkkz2I7qWZIO1EWln3kLGqpXiK:1LuY2Uv7qWL1j6XiK

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 6 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Agent.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Agent.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:3028
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {C15209D7-CF94-48BE-93CC-193592C5932B} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\PROGRA~3\Mozilla\wrvdfyg.exe
      C:\PROGRA~3\Mozilla\wrvdfyg.exe -hzyjzia
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:2548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~3\Mozilla\wrvdfyg.exe

          Filesize

          205KB

          MD5

          33df1b7161e268ea11038d00e7bb81bd

          SHA1

          2afe857db4b25f8617f90a34f5c87c62e3908c4f

          SHA256

          8ddfeb2dea4ff2dbcca92d2de05fc1367cf828ff9faa30ef00ed232d964369f8

          SHA512

          345067f917d2dc0e7412693eb2039232cba0644a2ebfcb4fe73fe7d1286e769871a7c2e30c17e477d9e3a48ae89bd3bf7d1aa9932e6536f0cfe3516652d2cfc1

        • memory/2548-9-0x0000000000400000-0x0000000000469000-memory.dmp

          Filesize

          420KB

        • memory/2548-10-0x0000000000400000-0x0000000000469000-memory.dmp

          Filesize

          420KB

        • memory/2548-11-0x00000000008A0000-0x00000000008FC000-memory.dmp

          Filesize

          368KB

        • memory/2548-12-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/2548-14-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/3028-0-0x0000000000400000-0x0000000000469000-memory.dmp

          Filesize

          420KB

        • memory/3028-1-0x0000000000400000-0x0000000000469000-memory.dmp

          Filesize

          420KB

        • memory/3028-3-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/3028-4-0x0000000000250000-0x00000000002AC000-memory.dmp

          Filesize

          368KB

        • memory/3028-2-0x0000000000400000-0x0000000000469000-memory.dmp

          Filesize

          420KB

        • memory/3028-6-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB