Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-03-2024 15:17

General

  • Target

    bc20ad793164e69ae9ed2666ac3225e5.exe

  • Size

    2.0MB

  • MD5

    bc20ad793164e69ae9ed2666ac3225e5

  • SHA1

    13f99851b862fcab6633290ea61c954f2d2b67a3

  • SHA256

    f8b078db7dab7e7a3bc6dcb94cde6a3988ca852cf9b95499fa59f0936ba7aed6

  • SHA512

    8042414a2f8edc758d8ccc87ac90771211fa6b9289e8431a1f71e44a94b1540e1acc83771256276a54e469c682f84841fdf441b6b9bb2920ee8d22e657f30491

  • SSDEEP

    49152:7ueHCQYhwqHcakLz0ibq6yqhkAWTNJDPXcakLz0ibq6yqh:7ueCQYKqHcakcibiqhkAWTXfcakcibiK

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc20ad793164e69ae9ed2666ac3225e5.exe
    "C:\Users\Admin\AppData\Local\Temp\bc20ad793164e69ae9ed2666ac3225e5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\bc20ad793164e69ae9ed2666ac3225e5.exe
      C:\Users\Admin\AppData\Local\Temp\bc20ad793164e69ae9ed2666ac3225e5.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2592
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\bc20ad793164e69ae9ed2666ac3225e5.exe" /TN WiDkBlJDe41e /F
        3⤵
        • Creates scheduled task(s)
        PID:2656
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN WiDkBlJDe41e > C:\Users\Admin\AppData\Local\Temp\1gKWWYRyU.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN WiDkBlJDe41e
          4⤵
            PID:2416

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1gKWWYRyU.xml

      Filesize

      1KB

      MD5

      4fdfda714c6fcf8c5e95123f232317ed

      SHA1

      c634bd2def49cfd85eee0380e1f2d8992f282d8b

      SHA256

      fd96dd59d53eaaec01bf3c3ee6ed92f36a0adb815923c0cc72efd82b2183c7b0

      SHA512

      d99f6888a27ac91d22564d2dfd5ea903d30725a8f4bbceaa4b59936d2e2b73a69e4904f57dfde466853585fe7a349bb18967da7ddf1d3871b89329bb299b876c

    • \Users\Admin\AppData\Local\Temp\bc20ad793164e69ae9ed2666ac3225e5.exe

      Filesize

      2.0MB

      MD5

      bef8dd8c8f0dd2e36979711aae2f9edf

      SHA1

      dbea4fcb5bf952c869007ab8ef692ef099442bd5

      SHA256

      5dd89c36c349fab06390aad1205e65ab5bf068987845d960864addc433443c8d

      SHA512

      96d9c50659c4b6112c01443dd70b7c5455fa73abd39fef352872b9f6c1245dc3e5f7fb92b03d59a470c87d537595bba5d3960372cc3ab79280762bec98b8a478

    • memory/2592-19-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2592-21-0x0000000022D90000-0x0000000022E0E000-memory.dmp

      Filesize

      504KB

    • memory/2592-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2592-31-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/2592-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3028-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3028-3-0x0000000000370000-0x00000000003EE000-memory.dmp

      Filesize

      504KB

    • memory/3028-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3028-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3028-15-0x0000000023300000-0x000000002355C000-memory.dmp

      Filesize

      2.4MB