98205f69438824b8c1444b3c28966bf307315aadd019c0f4764435ebbe5908f1

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HEUR-Trojan.Win32.exe
Size

370KB
MD5

2e8c7a6381c8163137b28ba6a944ed2e
SHA1

76ded4418b93baab8b4721e6320898a905172dd0
SHA256

98205f69438824b8c1444b3c28966bf307315aadd019c0f4764435ebbe5908f1
SHA512

9d01495745fd9603b00e1a8ab64e75cfe9a2322992cbdc60d40603fb26fb11aaad5279c40d75ec558b0fa21e37679aa76fea6fe69d76a9d5adc41504bdb80b00
SSDEEP

3072:nbJ8MJJ/pZ22HPc+Q0j40UvWw48ddLM6hMLIokjwrhpcSvMjQ12:l5XG20ka48ddLM6njNSn12

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/2772-0-0x0000000000400000-0x000000000045F000-memory.dmp	UPX
behavioral1/files/0x0009000000015c23-5.dat	UPX
behavioral1/memory/2876-7-0x0000000000400000-0x000000000045F000-memory.dmp	UPX

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2876	tbckyxk.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2772-0-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral1/files/0x0009000000015c23-5.dat	upx
behavioral1/memory/2876-7-0x0000000000400000-0x000000000045F000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tbckyxk.exe	HEUR-Trojan.Win32.exe
File created	C:\PROGRA~3\Mozilla\newtrln.dll	tbckyxk.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2772	HEUR-Trojan.Win32.exe
2876	tbckyxk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2876	2000	taskeng.exe	29
PID 2000 wrote to memory of 2876	2000	taskeng.exe	29
PID 2000 wrote to memory of 2876	2000	taskeng.exe	29
PID 2000 wrote to memory of 2876	2000	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2772

C:\Windows\system32\taskeng.exe
taskeng.exe {96B5E806-585E-401C-B0B6-6426BE7EF058} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\PROGRA~3\Mozilla\tbckyxk.exe
  C:\PROGRA~3\Mozilla\tbckyxk.exe -gqpcbye
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\tbckyxk.exe

Filesize
370KB

MD5
394fe83d1e405d4f8c403b03bd444425

SHA1
8328efc3a501f8e22ceec66f2e186f8d1147c2a9

SHA256
0be2274259bbe29202d16c859e9b8057267dae0d07193f9379d62bdf0dff3c41

SHA512
2042cfead5a34354f9f144d7cf2399d5b4a5425e9107ef527efb343f8197a3cbd5c176571462c990edfd659cc3d1a185bba1e055cd6e02dc270b20e15854665e

Download Submit
memory/2772-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2772-2-0x0000000000290000-0x00000000002EB000-memory.dmp

Filesize
364KB

Download
memory/2772-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2772-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2876-7-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2876-8-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/2876-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2876-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download