Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
06-03-2024 11:17
General
-
Target
b7433dc4de9676276bba102f171358aa.exe
-
Size
403KB
-
MD5
b7433dc4de9676276bba102f171358aa
-
SHA1
9c9f39850fe3a414651bab6c81b04b4d6d1523f0
-
SHA256
2a0295f5bab05005fd6e3bf733fcb5e5f153674ad01b8aaf2179e05d8580f3c7
-
SHA512
64a8e82899891fc809bf68c0c0a6f6d45e8b0dcba2445b77da2b2bc40895b48431aa8572096589450d48a2272200c4b17c0bc9539f5feaa46503cbfd3482b218
-
SSDEEP
6144:tBZn9oaRZ0RDG1NQv0Q/ldddHBDcuydIe/vgPux34toGwKMTMjexpnr90T:RlRZrNQv13ddH1crdrRxt4MgqrnyT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7433dc4de9676276bba102f171358aa.exe"C:\Users\Admin\AppData\Local\Temp\b7433dc4de9676276bba102f171358aa.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\fF02401DfIeL02401\fF02401DfIeL02401.exe"C:\ProgramData\fF02401DfIeL02401\fF02401DfIeL02401.exe" "C:\Users\Admin\AppData\Local\Temp\b7433dc4de9676276bba102f171358aa.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\fF02401DfIeL02401\fF02401DfIeL02401Filesize
208B
MD5060fc9695757a2c4fdb5bcab3aaee8cb
SHA165c55fc83158a06f5f9b5603750b5dcd5a540884
SHA2566c25bcf3e808b980701dd7da7167e783b10abc2a8f54c95ab5d7dafb0f541e33
SHA5129965893c9162ae8889a52a3f68038d952f2f4b3c8453fd54d8509675b2bb553ad09cf136dd44f6e747260bebf0aad430fdb4f6d36c57b3a74c0d31e65aa67514
-
\ProgramData\fF02401DfIeL02401\fF02401DfIeL02401.exeFilesize
403KB
MD525e1923025bc5c3872ee175f31d7a57f
SHA12cc75cc2c4feec1bc916610cc480a5487e5ef8dd
SHA2565e767d25848773c638f0bf0ffc570debcfca2cd8c3e055191e5ce554ed59467f
SHA512b29c9927c2e956afcb7014f21d81ccc3840952ef8a3801fae5b5104a25de73f57cb264f24eac04f0888c4b8460353bbe8d7a51aa15e9dd13149dbd34d9c71d22
-
memory/2268-104-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/2268-105-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/3028-0-0x0000000000250000-0x0000000000253000-memory.dmpFilesize
12KB
-
memory/3028-1-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/3028-2-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3028-81-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/3028-102-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB