Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 21:58

General

  • Target

    c6f4b9bab6462fdbe309df837cdca815.exe

  • Size

    765KB

  • MD5

    c6f4b9bab6462fdbe309df837cdca815

  • SHA1

    e0192257cb4d588580d71e5c70dd45f6b61f8869

  • SHA256

    3564665e908df57a48391e8790cde7626d573b466e6c75369d1a7c2a45b1a13c

  • SHA512

    26fc87ff9731d9c1c8419dda678bfd4a5d56e6710cb59602949f46dc960403b2ba6ae6656d83d46fee7a3b78cdbf2620d72746e15008de56999f2a46021a797f

  • SSDEEP

    12288:Dv0LoiTEytRUNgxCTIYUmmCQW2Evie1OLNR8X6xflO9dJ5IECpxOokLZsY:MvtRXYUmmjxe8f8XCcjukL2Y

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Program crash 18 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6f4b9bab6462fdbe309df837cdca815.exe
    "C:\Users\Admin\AppData\Local\Temp\c6f4b9bab6462fdbe309df837cdca815.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:320
    • C:\Users\Admin\AppData\Local\Temp\c6f4b9bab6462fdbe309df837cdca815.exe
      C:\Users\Admin\AppData\Local\Temp\c6f4b9bab6462fdbe309df837cdca815.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c6f4b9bab6462fdbe309df837cdca815.exe" /TN EvIYV7rY9c10 /F
        3⤵
        • Creates scheduled task(s)
        PID:3580
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN EvIYV7rY9c10 > C:\Users\Admin\AppData\Local\Temp\9fN9ZCL.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3804
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN EvIYV7rY9c10
          4⤵
            PID:3160
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 616
          3⤵
          • Program crash
          PID:2976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 640
          3⤵
          • Program crash
          PID:3800
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 716
          3⤵
          • Program crash
          PID:4516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 648
          3⤵
          • Program crash
          PID:4348
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 740
          3⤵
          • Program crash
          PID:740
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 780
          3⤵
          • Program crash
          PID:4600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1460
          3⤵
          • Program crash
          PID:3208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1880
          3⤵
          • Program crash
          PID:2912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2140
          3⤵
          • Program crash
          PID:2456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2100
          3⤵
          • Program crash
          PID:720
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1920
          3⤵
          • Program crash
          PID:3088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2128
          3⤵
          • Program crash
          PID:3484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 1952
          3⤵
          • Program crash
          PID:2080
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2116
          3⤵
          • Program crash
          PID:2784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2176
          3⤵
          • Program crash
          PID:2860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2228
          3⤵
          • Program crash
          PID:4524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 2120
          3⤵
          • Program crash
          PID:3484
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 712
          3⤵
          • Program crash
          PID:1672
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4324 -ip 4324
      1⤵
        PID:768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4324 -ip 4324
        1⤵
          PID:4960
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4324 -ip 4324
          1⤵
            PID:3920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4324 -ip 4324
            1⤵
              PID:1132
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4324 -ip 4324
              1⤵
                PID:4944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4324 -ip 4324
                1⤵
                  PID:4320
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4324 -ip 4324
                  1⤵
                    PID:1684
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4324 -ip 4324
                    1⤵
                      PID:3148
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4324 -ip 4324
                      1⤵
                        PID:3040
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4324 -ip 4324
                        1⤵
                          PID:5080
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4324 -ip 4324
                          1⤵
                            PID:3196
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4324 -ip 4324
                            1⤵
                              PID:1816
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4324 -ip 4324
                              1⤵
                                PID:4280
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4324 -ip 4324
                                1⤵
                                  PID:5024
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4324 -ip 4324
                                  1⤵
                                    PID:2292
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4324 -ip 4324
                                    1⤵
                                      PID:5040
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4324 -ip 4324
                                      1⤵
                                        PID:4164
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4324 -ip 4324
                                        1⤵
                                          PID:3208

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\9fN9ZCL.xml

                                          Filesize

                                          1KB

                                          MD5

                                          02e0829ebcf0a74714cb08e80d453ab0

                                          SHA1

                                          6eb4a19ed1b153f1c36c1690967890aa81c7be92

                                          SHA256

                                          a3930dac9b652e4a9cc918ccf81eb17bb1d3d0d5747329510c981009278ab95b

                                          SHA512

                                          baa5a6b456dc1b25c84c73f4ffdb5333d3b9c36bd0bd4308da33f8955d25ecaa792ae1206679e5f759af2d82d8a66bcaa6f8de442c9b7097835fdcb0bad5cda4

                                        • C:\Users\Admin\AppData\Local\Temp\c6f4b9bab6462fdbe309df837cdca815.exe

                                          Filesize

                                          765KB

                                          MD5

                                          ed7158523d7f8ca39799c8d019fbdc7f

                                          SHA1

                                          0504ec3b65886c28313f96a8869b6ba8b0f327da

                                          SHA256

                                          cbc8e9d0dfe892b962135c84cf6dd7916554ea097575cacd441cdcee74264f45

                                          SHA512

                                          7ba44e7feaca115eac48617824f1bbca05b450739a86521117f6b5dc611a9b8a548e688c0d3825a2aebc2179f1ae22860400430f56d16e538020d1b9184ec9ab

                                        • memory/320-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/320-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/320-4-0x0000000024FE0000-0x000000002505E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/320-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/4324-15-0x00000000016E0000-0x000000000175E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/4324-18-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/4324-22-0x00000000004B0000-0x000000000051B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/4324-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4324-41-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB