b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56

Analysis

max time kernel
120s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56.exe
Size

137KB
MD5

f6e542a136a020ec920246360c3640c1
SHA1

26b15030a1c69bf3c5e4f6b064215586b9158ddc
SHA256

b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56
SHA512

06d083835ab5ac2fdc2c9ef606f6a7d509621edc8b62c13e738ecdeb7611e2e36104850b5b993644cf619ab3b8b60041563e5f5e967b72669ff25727ac18afc9
SSDEEP

3072:AE9ByF5wP7Ht99mbaa+vKAzWvSVJSwpi6DsHH:7907wTr9mea+i6WKQP

Score

9^/10

aspackv2 persistence

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral1/memory/2288-0-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2288-1-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2288-2-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00040000000130fc-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2608-10-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2608-11-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2608-12-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00040000000130fc-8.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2608	nhadrjb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nhadrjb.exe	b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56.exe
File created	C:\PROGRA~3\Mozilla\mrcfdgn.dll	nhadrjb.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2288	b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56.exe
2608	nhadrjb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2608	2520	taskeng.exe	29
PID 2520 wrote to memory of 2608	2520	taskeng.exe	29
PID 2520 wrote to memory of 2608	2520	taskeng.exe	29
PID 2520 wrote to memory of 2608	2520	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56.exe
"C:\Users\Admin\AppData\Local\Temp\b1b66a8407e289005d606246ae077b27f75ead5a8f6fe96768c076fe73269e56.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2288

C:\Windows\system32\taskeng.exe
taskeng.exe {9CBD2BDE-F86F-4052-A1AA-4ED54310E550} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\PROGRA~3\Mozilla\nhadrjb.exe
  C:\PROGRA~3\Mozilla\nhadrjb.exe -giukxrm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nhadrjb.exe

Filesize
137KB

MD5
00ca108e77aa434f8c48da183dc3f88f

SHA1
cf17ea59a69b0418181b6d340ca3bf613326045f

SHA256
6070bf7efa2199cdbc1130268c6ec97ecc1f75ec46fb08629f39a5de5479b82e

SHA512
f4ef584864afa79bdd29d6bd490c2028385b35c7e39a1c7716b5dfcf86cfc5039d81d1c15981da4944db18c10fa790c4bec072c08f2a79a8602bd0508222f252

Download Submit
memory/2288-7-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2288-2-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2288-3-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2288-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2288-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2288-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2288-1-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2608-10-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2608-11-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2608-12-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2608-13-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2608-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2608-16-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2608-17-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download