538f723e0582849d3b5c51d75e351be914793ac7db3c89174f6e39269e0d2b4a

Analysis

max time kernel
13s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

538f723e0582849d3b5c51d75e351be914793ac7db3c89174f6e39269e0d2b4a.exe
Size

148KB
MD5

32367b2b4bc81bcbb07e72e09c7c85de
SHA1

2081c46b3ec1b937c48d864e85666dfe607eb03f
SHA256

538f723e0582849d3b5c51d75e351be914793ac7db3c89174f6e39269e0d2b4a
SHA512

adb7362e705209872c63be6b86da6270c379d9c72f4f144e167374404ea7655bd613546ca37bfdc728c80c11d5eaab0630d2fe83f0c47b3764e2f6da4aca344f
SSDEEP

3072:2CMiqJl3v1S4AsvdhxBz8bNk/AKItB/pL/s9hlSLUFWzV:2CMzfM4vxBIO+XpDnUUzV

Score

9^/10

persistence

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x0000000000429000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2360-7-0x0000000000400000-0x0000000000429000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x0030000000015c50-8.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2552-10-0x0000000000400000-0x0000000000429000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2552-17-0x0000000000400000-0x0000000000429000-memory.dmp	INDICATOR_EXE_Packed_MPress

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2552	xobykzk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\xobykzk.exe	538f723e0582849d3b5c51d75e351be914793ac7db3c89174f6e39269e0d2b4a.exe
File created	C:\PROGRA~3\Mozilla\yvzxgmj.dll	xobykzk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2552	844	taskeng.exe	29
PID 844 wrote to memory of 2552	844	taskeng.exe	29
PID 844 wrote to memory of 2552	844	taskeng.exe	29
PID 844 wrote to memory of 2552	844	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\538f723e0582849d3b5c51d75e351be914793ac7db3c89174f6e39269e0d2b4a.exe
"C:\Users\Admin\AppData\Local\Temp\538f723e0582849d3b5c51d75e351be914793ac7db3c89174f6e39269e0d2b4a.exe"
1⤵
- Drops file in Program Files directory
PID:2360

C:\Windows\system32\taskeng.exe
taskeng.exe {052D9948-D4E2-40B0-AFC4-5229EE98F25F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\PROGRA~3\Mozilla\xobykzk.exe
  C:\PROGRA~3\Mozilla\xobykzk.exe -clyupje
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\xobykzk.exe

Filesize
148KB

MD5
fa4fea1450f705d9cd809fd27c2017cd

SHA1
57cd2ce443567506a8fe5be8a329a8d862444679

SHA256
48de0ec7cfd408689e4a6ea70844f5107bc0e028ec8e713a26f8cf50de07568e

SHA512
9974409f56fca287d76d19616ac2015f53306e8348036e0026f7c4326905128ff5b2b79275cbba1f6c5941106c457fa0ffb628e0d7475ef165b87b22d8a089e9

Download Submit
memory/2360-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2360-1-0x0000000000220000-0x000000000027B000-memory.dmp

Filesize
364KB

Download
memory/2360-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download