Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 07:05

General

  • Target

    b417520adc01a922c56f942f4075de98.exe

  • Size

    10KB

  • MD5

    b417520adc01a922c56f942f4075de98

  • SHA1

    8835512659b8a04266a2643bacea84e2dc4e95d7

  • SHA256

    9b391d5bacc3b30ef87d8aa2197ba6d49c254b21d9d1901e79a2e90c9307c8a9

  • SHA512

    716a9bf30eea000cc1bae67642e7b70f34c0a38d5cf52049baca458e95f21bd9228a09b9cdd779928f27af2f9b25f4553cce02d58b24c70bca0456e974b33ae0

  • SSDEEP

    192:70Abfjwc03Ex8Swcp/nncrR37vOhGytPg+Q+:7fDEx3E6SnPcrRLly9gd+

Score
8/10

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b417520adc01a922c56f942f4075de98.exe
    "C:\Users\Admin\AppData\Local\Temp\b417520adc01a922c56f942f4075de98.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\SysWOW64\reglakok.exe
      C:\Windows\system32\reglakok.exe ˜‰
      2⤵
      • Executes dropped EXE
      PID:1384
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\b417520adc01a922c56f942f4075de98.exe.bat
      2⤵
      • Deletes itself
      PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b417520adc01a922c56f942f4075de98.exe.bat

    Filesize

    182B

    MD5

    1c8a49393889d8a23037a8e9d612f8df

    SHA1

    f95aedfb1474c223df41d4533ad9a2720ff5d143

    SHA256

    e38106c81f221a9437c73dfcae1807b7ac227ed1d74bcfb894e40d9c3c18d705

    SHA512

    869116b121164d8623bfc240b29e2b5419b212db9e2c8eca146e458006ecf8df31e92418b26e686e0e42d9d61cf654fa1caac767cee846fd23c3e97e6eb877ea

  • \Windows\SysWOW64\reglakok.exe

    Filesize

    10KB

    MD5

    b417520adc01a922c56f942f4075de98

    SHA1

    8835512659b8a04266a2643bacea84e2dc4e95d7

    SHA256

    9b391d5bacc3b30ef87d8aa2197ba6d49c254b21d9d1901e79a2e90c9307c8a9

    SHA512

    716a9bf30eea000cc1bae67642e7b70f34c0a38d5cf52049baca458e95f21bd9228a09b9cdd779928f27af2f9b25f4553cce02d58b24c70bca0456e974b33ae0

  • memory/1384-11-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/1384-21-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/1784-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/1784-4-0x0000000000030000-0x000000000003F000-memory.dmp

    Filesize

    60KB

  • memory/1784-19-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB