Resubmissions

01-03-2024 13:36

240301-qwjzlsgf67 7

01-03-2024 10:28

240301-mh2eysff34 7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-03-2024 13:36

General

  • Target

    TPS V2 Umi Keygen.exe

  • Size

    1.3MB

  • MD5

    cda78cc7005ed4318373322df18e9f1b

  • SHA1

    5b32d63c65c9e0c2d500fd6cce90d3c5e5a87b19

  • SHA256

    21b9d087307d06d9ca9d92d9a7721429342bf923263f5b5355b2f23650eb2640

  • SHA512

    aadee4c2954554cd4599a397635c7f3bb92c428cfd53057913782bc7fcaf4d91bab0cbb574f14ad4f84cf4223ea506a7db5931a2cf7cb2130a6c0e05b770761e

  • SSDEEP

    24576:XubsnafAPyjzbmlQQyCqpdh1PfXOrPBuKCnFnnW68B6UpCfh8VzSjBlyq/t/tD:fI3mSQFErnMJujnFnV8B6xh2zYoqNtD

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\TPS V2 Umi Keygen.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\HuaweiUpdateLibrary.dll

    Filesize

    21KB

    MD5

    81a188ac5da8e396126bbff00430f6f9

    SHA1

    ab98043226e10a53101835cbdb1c0f8068c9ef3a

    SHA256

    6db66509ae09649c059b63d9ca036c7a37dc213ac478ffd03223efb4eec6b922

    SHA512

    4942a7666f7e58b213e2a1da14f3be32d81fbca0f063a5dd775957d8550538e566f654131065e50eda3b0cb931637536fe472cd677f17e7fd8ba5808be0ff059

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TPS Tool V3.exe

    Filesize

    430KB

    MD5

    aa307365f26331d9172190d595771601

    SHA1

    f57d8851c804c94578277c32f377ab14f8ab1fa5

    SHA256

    3bdb8e8f053bbf758588c7dc39ecab3bca2152f4d9f20b4ebc5fe52d38592e4a

    SHA512

    3891c7e2f141d1b8ebdad1061b8cbe9f51c5a49cbaace6cae6524d7edffa128285e96d79ba860278b7f37bae81c32e3a32eea89ec1b4436d668f4a3056a34420

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\tpsControllerLib.dll

    Filesize

    541KB

    MD5

    6d1a30cea4ad42edb142dfa44832e108

    SHA1

    e7fb38884f7586236ca6adebd9bb12ebe1784748

    SHA256

    1c38284d7cfb0b7dd09012d9de10e92a1c9ee7a8ea33f6489201a71d80d12457

    SHA512

    ae96a8d9ce586ac83a31d8d381347c28ab1863c138bd1b0ffbe1ac4798bc1358e61bf72bbcf0436dac2a730cb468c1ccc046a64488e02ef775808a23bd3f565d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\tpsThemeLib.dll

    Filesize

    433KB

    MD5

    bbf4d1132f017b5e723402caa109c70c

    SHA1

    d91dddbb8b1b2b516d7956b04e57864d4e47c8b0

    SHA256

    037b9e81977a0fbdcebf942f88fdf548c3e9173df5a8fc55236eeefe30ee6fbb

    SHA512

    82249ed7f81a2242ac2846df7835807134fddc8a9e7191b581959bcbca24c725ce6dbce64a7b82d5e6c815273084a2f0a3bf176552c43b3c353812f3cb572e86

  • memory/2664-27-0x0000000005820000-0x0000000005830000-memory.dmp

    Filesize

    64KB

  • memory/2664-20-0x0000000005BB0000-0x0000000006154000-memory.dmp

    Filesize

    5.6MB

  • memory/2664-23-0x0000000005820000-0x0000000005830000-memory.dmp

    Filesize

    64KB

  • memory/2664-24-0x0000000006400000-0x000000000640A000-memory.dmp

    Filesize

    40KB

  • memory/2664-25-0x0000000005820000-0x0000000005830000-memory.dmp

    Filesize

    64KB

  • memory/2664-26-0x0000000072C60000-0x0000000073410000-memory.dmp

    Filesize

    7.7MB

  • memory/2664-21-0x0000000005600000-0x0000000005692000-memory.dmp

    Filesize

    584KB

  • memory/2664-22-0x0000000005580000-0x00000000055E6000-memory.dmp

    Filesize

    408KB

  • memory/2664-31-0x0000000009270000-0x000000000938E000-memory.dmp

    Filesize

    1.1MB

  • memory/2664-32-0x0000000002E60000-0x0000000002E61000-memory.dmp

    Filesize

    4KB

  • memory/2664-33-0x0000000005820000-0x0000000005830000-memory.dmp

    Filesize

    64KB

  • memory/2664-34-0x00000000093B0000-0x0000000009704000-memory.dmp

    Filesize

    3.3MB

  • memory/2664-38-0x0000000009250000-0x000000000925C000-memory.dmp

    Filesize

    48KB

  • memory/2664-19-0x0000000072C60000-0x0000000073410000-memory.dmp

    Filesize

    7.7MB

  • memory/2664-18-0x0000000000B30000-0x0000000000BA8000-memory.dmp

    Filesize

    480KB

  • memory/2664-42-0x00000000097F0000-0x00000000098C2000-memory.dmp

    Filesize

    840KB