Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/03/2024, 23:30

General

  • Target

    a146b753ac67bd29bea524625bc84ee179a8e41f30128c384c3e812c5a1fb7e4.exe

  • Size

    178KB

  • MD5

    5149131598da41edc109bae5d2912563

  • SHA1

    db21582afb41ab861eb7c40cc2320fdaecb346b3

  • SHA256

    a146b753ac67bd29bea524625bc84ee179a8e41f30128c384c3e812c5a1fb7e4

  • SHA512

    8def3f506d0f20c035310be2847f13c9740e95fb094e1cd6e066ab3a001efce066dd993078ad924c8db46168806ee5a7ce8020005a8f0b9d6004490f075b9537

  • SSDEEP

    3072:+Yubs4vIPfIOKyCRfyJiJJMXybJg30TZZ+MbpqdNjfBDckH8sbigzwQj1O:Puk6fK6tixMbwNL+kDrI

Score
9/10

Malware Config

Signatures

  • Detects executables packed with ASPack 5 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a146b753ac67bd29bea524625bc84ee179a8e41f30128c384c3e812c5a1fb7e4.exe
    "C:\Users\Admin\AppData\Local\Temp\a146b753ac67bd29bea524625bc84ee179a8e41f30128c384c3e812c5a1fb7e4.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:2648
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {6494064D-41D5-4A06-9565-9ECA20CCDD9F} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\PROGRA~3\Mozilla\tbckyxk.exe
      C:\PROGRA~3\Mozilla\tbckyxk.exe -gqpcbye
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      PID:2984

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~3\Mozilla\tbckyxk.exe

          Filesize

          178KB

          MD5

          34ac307216774702e454df3fa7b1fbce

          SHA1

          c6eaa00f20deffd11f2bfa15641b714becf0eaf4

          SHA256

          9d04f9cd1f8d0ea52bbef222bf28d781221ac22f02b6f124d4861fee92064144

          SHA512

          f31593308e62a8608b94e9d31bcb6da1500c1ce4496ba9a8db3f4f44dc5331bd012d28e29cebdfc721787bd5eaaf6baf90556cee60945edb438949108c216f1f

        • memory/2648-7-0x0000000000260000-0x00000000002BB000-memory.dmp

          Filesize

          364KB

        • memory/2648-1-0x0000000000400000-0x000000000045E000-memory.dmp

          Filesize

          376KB

        • memory/2648-3-0x0000000000260000-0x00000000002BB000-memory.dmp

          Filesize

          364KB

        • memory/2648-4-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/2648-6-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/2648-0-0x0000000000400000-0x000000000045E000-memory.dmp

          Filesize

          376KB

        • memory/2648-2-0x0000000000400000-0x000000000045E000-memory.dmp

          Filesize

          376KB

        • memory/2984-10-0x0000000000400000-0x000000000045E000-memory.dmp

          Filesize

          376KB

        • memory/2984-13-0x0000000000290000-0x00000000002EB000-memory.dmp

          Filesize

          364KB

        • memory/2984-14-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/2984-16-0x0000000000400000-0x000000000045B000-memory.dmp

          Filesize

          364KB

        • memory/2984-17-0x0000000000290000-0x00000000002EB000-memory.dmp

          Filesize

          364KB