Analysis
-
max time kernel
147s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-03-2024 17:21
Behavioral task
behavioral1
Sample
077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb.exe
Resource
win10v2004-20240226-en
General
-
Target
077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb.exe
-
Size
137KB
-
MD5
4525e64f5328bdb452c0729e30fa7b6b
-
SHA1
236d4266fe130988f9a9bb96b4f3e505926d1399
-
SHA256
077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb
-
SHA512
e620047b039c15a5381f331bf349acd27cc9cb7fa2206e6662a80cdada8306ec6c36fe07ee1d163a582c2660e1c09144d5becfdf6657232103aaf5890a853701
-
SSDEEP
3072:AE9ByF5wP7Ht99mbaa+vKAzWvSVJSwpi6Ds2:7907wTr9mea+i6WKQu
Malware Config
Signatures
-
Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/2092-0-0x0000000000400000-0x000000000045E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2092-2-0x0000000000400000-0x000000000045E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2092-1-0x0000000000400000-0x000000000045E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000023225-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000023225-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2284-11-0x0000000000400000-0x000000000045E000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2284-12-0x0000000000400000-0x000000000045E000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/files/0x0007000000023225-7.dat aspack_v212_v242 behavioral2/files/0x0007000000023225-6.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2284 npprbsm.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\npprbsm.exe 077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb.exe File created C:\PROGRA~3\Mozilla\yqwyzrf.dll npprbsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb.exe"C:\Users\Admin\AppData\Local\Temp\077c87a5c026f03db25d6c3da7cf2ef2ea328132055e06cfd0eb70ad56ee3bbb.exe"1⤵
- Drops file in Program Files directory
PID:2092
-
C:\PROGRA~3\Mozilla\npprbsm.exeC:\PROGRA~3\Mozilla\npprbsm.exe -eqrcqtf1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD53938d526058ef70871cfa181e7571a39
SHA1d262f103d1ce6454c730a2b8c39ce484eb4caa2b
SHA2569ce53b5b655a5369c5c8e7cb6f8ce568fbd1adb67d01f18aa4fbb0b7bbffe452
SHA512db1a8645427b685d3ee1c8cf3aea099c896dfdba411065e2557b34147a5b79029805a396c77ffede86a8a9681bb1717fd5e4b6bb2d1ab872755adad763bfd8ec