Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2024, 09:14

General

  • Target

    b8604162466154d6f90d7df94111e20a.exe

  • Size

    1003KB

  • MD5

    b8604162466154d6f90d7df94111e20a

  • SHA1

    5f979878bddec4e103ebaa75713bd097d13ce4e7

  • SHA256

    9e18a89c79fba1921f5de97ed8063d76b8af32c54e5cf2b688f1149d4a227dc5

  • SHA512

    98aa1fe28392f171cdfee660c30414d8bfaf083cd22d43a1454dc39f2c00e150e1aaa72496729d666abbcaa296980e55eb0b9431bde63927a73e6ece2c4bc5d3

  • SSDEEP

    24576:JLSP60v/4yHtDPDJZ6VknyN2aPHrSVp7HT6O9:xY60v/4yHtDPDJZowyN2aTSVpT+O9

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe
    "C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe
      C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe" /TN 5xzkGEJ1bdbc /F
        3⤵
        • Creates scheduled task(s)
        PID:2620
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN 5xzkGEJ1bdbc > C:\Users\Admin\AppData\Local\Temp\5zcn3gYv.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN 5xzkGEJ1bdbc
          4⤵
            PID:2544

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5zcn3gYv.xml

      Filesize

      1KB

      MD5

      d1b16d63c35cb3753238d60f878eff6d

      SHA1

      e9b6aac705b3e48ad547678858a6657b3f669a8b

      SHA256

      ef42b034a5dfabe1f5bd4231ac87cf6f605b9231f1dc62e985832c6a7bb7164b

      SHA512

      621f4ec263b753c413914cbb9e37babb67281e1e40eca855de07e6f81507dd37bf487a6318cf71a4c9e6911f04d26089f6c3eba8964121ee82eade3af8a3d3b1

    • C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe

      Filesize

      896KB

      MD5

      2f93b638314778f871ed6392e16a5574

      SHA1

      0e9d1f73057d3a71855e577d15f01aee09900926

      SHA256

      137ff9ca4c858aeff75cdaaa52a51beb60f2ec8246bd68992d95e098130045bf

      SHA512

      c53c4dd3467b11ac1e6a566ab2b43591e00248b5fd09a10ce088df4c0f3d36254918d74a6b535588daa2a51775024215d0bf53523d739727cc22e255d7bdd1c3

    • C:\Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe

      Filesize

      768KB

      MD5

      c6e425a212bf66993030094f89114cf4

      SHA1

      67bc58eccef0345f65f609a7cf0033d12186a9e1

      SHA256

      2399712fad2c8e5d33907ae0bf6d401326849f5e4c44a967e448fe70f60275be

      SHA512

      d3395aba26a996d74acf67f9be0d8612f5b4ace2e4b46bc4cb08fc24c21a338fb6eb8b49960dad88490886a4409e32b717c708db4032c7ee964b0102159e734a

    • \Users\Admin\AppData\Local\Temp\b8604162466154d6f90d7df94111e20a.exe

      Filesize

      960KB

      MD5

      a622623ec89900686b38cc0d9ce83067

      SHA1

      ef01ec514e956a7971dbcbff5040942ffced22e7

      SHA256

      97b4109763aa541fd5f304f0da941148aa5d75ec3099d7c8b2a472b722727a08

      SHA512

      152570e57cb6331f1f337f8a440f90d883723c330c2f18241bf5875b15f010036a3572d3c7b7167105ee21e8fa2205d5c4b0d51186a7925f2a5e7f6c271d527e

    • memory/2012-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2012-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2012-16-0x0000000022F00000-0x000000002315C000-memory.dmp

      Filesize

      2.4MB

    • memory/2012-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2012-3-0x0000000000370000-0x00000000003EE000-memory.dmp

      Filesize

      504KB

    • memory/2012-53-0x0000000022F00000-0x000000002315C000-memory.dmp

      Filesize

      2.4MB

    • memory/3044-19-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3044-21-0x0000000000270000-0x00000000002EE000-memory.dmp

      Filesize

      504KB

    • memory/3044-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3044-31-0x00000000002F0000-0x000000000035B000-memory.dmp

      Filesize

      428KB

    • memory/3044-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB