866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c15e14c3d2754f39fb12586831d1c5f8.exe
Size

587KB
MD5

c15e14c3d2754f39fb12586831d1c5f8
SHA1

5db81b8e550ac1c91161927715484cacaaa323a6
SHA256

866444d9139177a3c6dc187dccd1629a48b402c6ee401075c13d51e6224cc1ca
SHA512

0f9e763be02591761e8a2f17165455cdeeccac4bebcd3ccb6c6159cad262a56762c7f5d7bd047c4647b1bbe61d0f67f11a7f87a0aa299b5d9bd20132aaf7d9bd
SSDEEP

12288:iXe9PPlowWX0t6mOQwg1Qd15CcYk0We1rgGkOiEWBp7eIh8EjnbArUUmMv:3hloDX0XOf41iEI7QYnbAhbv

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/848-0-0x0000000000400000-0x0000000000556000-memory.dmp	upx
behavioral1/memory/848-9-0x0000000000400000-0x0000000000556000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/848-9-0x0000000000400000-0x0000000000556000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
848	c15e14c3d2754f39fb12586831d1c5f8.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2556	848	c15e14c3d2754f39fb12586831d1c5f8.exe	28
PID 848 wrote to memory of 2556	848	c15e14c3d2754f39fb12586831d1c5f8.exe	28
PID 848 wrote to memory of 2556	848	c15e14c3d2754f39fb12586831d1c5f8.exe	28
PID 848 wrote to memory of 2556	848	c15e14c3d2754f39fb12586831d1c5f8.exe	28
PID 848 wrote to memory of 2556	848	c15e14c3d2754f39fb12586831d1c5f8.exe	28

C:\Users\Admin\AppData\Local\Temp\c15e14c3d2754f39fb12586831d1c5f8.exe
"C:\Users\Admin\AppData\Local\Temp\c15e14c3d2754f39fb12586831d1c5f8.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\c15e14c3d2754f39fb12586831d1c5f8.exe"
  2⤵
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gwytcqttmkmc

Filesize
219KB

MD5
097a04a896638287260aad7889f6bc71

SHA1
470e52ef8aef07d757863dd809540ceeee52d6f9

SHA256
93af202ac85c36f2904e3ac3a768a5aa3b6d98a1746135bc53af5b0d0fe0fc9d

SHA512
5ba1ea01bb651cb9271e103a1dbb089c5114d1747a93a373e9ae962f5a6233a1d1e41713d4a07992324c10ee98c30d7e6d4c8a9da2ec84c9e6474f63ced92f9f

Download Submit
memory/848-0-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download
memory/848-7-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/848-8-0x0000000000B00000-0x0000000000B02000-memory.dmp

Filesize
8KB

Download
memory/848-9-0x0000000000400000-0x0000000000556000-memory.dmp

Filesize
1.3MB

Download