25f0c4353a5c2202b9fc4341a09065ddda18fcf97901deed1dc0ca66256afa25

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7ab09e1faf0879a1ad9ff75e3bde789.exe
Size 434KB
Sample240314-ewbsfsac3z
SHA256 25f0c4353a5c2202b9fc4341a09065ddda18fcf97901deed1dc0ca66256afa25
MD5 c7ab09e1faf0879a1ad9ff75e3bde789
SHA1 7ba35461c9a79b1e463796314721a74199583754
SHA512 071899e3992c80f08825a32c76d89f209b789fa1073f9b3ddd6040524e90c895f1e9e8996a2bdb9930246752ee7340b2bffa4c8705e439e8320a150eeae866b2
SSDEEP 12288:I5O9/jJNjt4AvdBMKUGqoTuDuMdHJFpEM:II97JgqIoTuDTpr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

aspackv2 persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023263-32.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	c7ab09e1faf0879a1ad9ff75e3bde789.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	dnf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
3948	dnf.exe
4664	dn.exe
708	dd.exe
116	panlong.exe

Loads dropped DLL 2 IoCs

pid	Process
3036	rundll32.exe
1620	rundll32.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023265-12.dat	upx
behavioral2/memory/3948-17-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/files/0x0008000000023264-20.dat	upx
behavioral2/memory/4664-36-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/4664-50-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral2/memory/3948-57-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dxe.dat	dn.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Intel\VulInfo.dat	dnf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winsys.tmp	dn.exe
File created	C:\Windows\~324.tmp	dn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "regedit.exe /s \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2112	regedit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
116	panlong.exe
116	panlong.exe
116	panlong.exe
116	panlong.exe
1620	rundll32.exe
1620	rundll32.exe
1620	rundll32.exe
1620	rundll32.exe
3036	rundll32.exe
3036	rundll32.exe
3036	rundll32.exe
3036	rundll32.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
116	panlong.exe
116	panlong.exe
116	panlong.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
116	panlong.exe
116	panlong.exe
116	panlong.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
116	panlong.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3948	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	102
PID 780 wrote to memory of 3948	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	102
PID 780 wrote to memory of 3948	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	102
PID 780 wrote to memory of 4664	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	103
PID 780 wrote to memory of 4664	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	103
PID 780 wrote to memory of 4664	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	103
PID 780 wrote to memory of 708	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	104
PID 780 wrote to memory of 708	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	104
PID 780 wrote to memory of 708	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	104
PID 4664 wrote to memory of 4676	4664	dn.exe	105
PID 4664 wrote to memory of 4676	4664	dn.exe	105
PID 4664 wrote to memory of 4676	4664	dn.exe	105
PID 780 wrote to memory of 116	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	106
PID 780 wrote to memory of 116	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	106
PID 780 wrote to memory of 116	780	c7ab09e1faf0879a1ad9ff75e3bde789.exe	106
PID 3948 wrote to memory of 3036	3948	dnf.exe	107
PID 3948 wrote to memory of 3036	3948	dnf.exe	107
PID 3948 wrote to memory of 3036	3948	dnf.exe	107
PID 4676 wrote to memory of 1620	4676	cmd.exe	109
PID 4676 wrote to memory of 1620	4676	cmd.exe	109
PID 4676 wrote to memory of 1620	4676	cmd.exe	109
PID 1620 wrote to memory of 3604	1620	rundll32.exe	110
PID 1620 wrote to memory of 3604	1620	rundll32.exe	110
PID 1620 wrote to memory of 3604	1620	rundll32.exe	110
PID 3604 wrote to memory of 2112	3604	cmd.exe	112
PID 3604 wrote to memory of 2112	3604	cmd.exe	112
PID 3604 wrote to memory of 2112	3604	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\c7ab09e1faf0879a1ad9ff75e3bde789.exe
"C:\Users\Admin\AppData\Local\Temp\c7ab09e1faf0879a1ad9ff75e3bde789.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:780
- C:\windows\temp\dnf.exe
  "C:\windows\temp\dnf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" 6210.ime,Runed C:\windows\temp\dnf.exe
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3036
- C:\windows\temp\dn.exe
  "C:\windows\temp\dn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rundll32.exe C:\Windows\~324.tmp Run C:\windows\temp\dn.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Windows\~324.tmp Run C:\windows\temp\dn.exe
      4⤵
      Loads dropped DLL
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Users\Admin\AppData\Local\Temp\a.reg
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3604
      - C:\Windows\SysWOW64\regedit.exe
        
        "regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\a.reg"
        6⤵
        Runs .reg file with regedit
        
        PID:2112
- C:\windows\temp\dd.exe
  "C:\windows\temp\dd.exe"
  2⤵
  - Executes dropped EXE
  PID:708
- C:\windows\temp\panlong.exe
  "C:\windows\temp\panlong.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VulInfo.dat

Path C:\Program Files\Intel\VulInfo.dat
Size 127B
SHA256 8caa4a587b7a0b08795d9f1faffb6cc48e13c670df9169736d2f6ae4ffe58385
MD5 0686c2fa63ce3a6950da8e63c6ea50b9
SHA1 288b1dbb053d03a2cf1f447b66bee1e2c425cfca
SHA512 0f7a0b3b8c8798795b9a3423ab13abf989f4b3b50619e642e286603a08eb3f629db61f14be17ef0f9fa3478685cafbcae03ed28381627df18d83a12ee823272a
MD5 SHA1 SHA512

Submit Download

a.reg

Path C:\Users\Admin\AppData\Local\Temp\a.reg
Size 155B
SHA256 7053cd32096092ea33e820dda12b99f6899d940365fd321ab50488f66935d125
MD5 d6e2efc31e7fd38494572d1be807642b
SHA1 bc2cd67c81ac39335549c8ea2d8b3917d20229ae
SHA512 3450784c533bad4d2bda3f812387b6008ee53f9c3cbdbaeab1f9bd4efbc0efa80c1bbae047a0cad9df340c06b9c397c342aab8e1bb48121e348e8bb08e6f311c
MD5 SHA1 SHA512

Submit Download

6210.ime

Path C:\Windows\SysWOW64\6210.ime
Size 79KB
SHA256 4ebc9d72a5123cf9c5dcc4a6cc872411e7e6702240ebbf5ac81eadd1449f77b5
MD5 8db07da41a14d36b8ffbe15857a57e43
SHA1 0d321125d964ca2ede3a98bc84b2bf90f7ed1d41
SHA512 730eccb9835322094d07c30315c5ffaece4e0d7c2e2f5bf105dd7e74eebce172e096ee98819c83cb9c83dd810fc2e9b736aebcd12c66da32b1d5963c4ddadeaa
SSDEEP 1536:Qn4gGjZpD0jt0xShJJEHpAHNHrIur7UXmRQCrJTloA/uoXlPHVih4e:Qn4gGkjtVEJAHNHrIur7XJrT5/uoXlP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd.exe

Path C:\Windows\Temp\dd.exe
Size 60KB
SHA256 f1c745510744417bdeb6dc6c693b0844b6f46d4a1d45424bc3e2a0e8bd379386
MD5 a84b040b5b42e25c4b40eee9235ad38d
SHA1 f5f2132380883d589cb6ca590ce501a4c5447f81
SHA512 6e50010a594afcd4f2d90abf92bf385ddc6bc04cf1490f9909e0b7637dd789795553a9baf17c151e2c2dc629965697f9b32d09d6591beac5815066e52efc26ce
SSDEEP 1536:qgyrgUUOW0QeXIgxESi0P1rcfqFfnBuo/tU/K8SrCBn:jbb07XXzqqxngo/kt
MD5 SHA1 SHA512 SSDEEP

Submit Download

dn.exe

Path C:\Windows\Temp\dn.exe
Size 14KB
SHA256 43f5ba4ac00edceb91a1230febe7a43a278100d04b593bffa9835f24ad1beeaa
MD5 69c1e40f38d7b18fc449bf72f8017074
SHA1 d9c82f9df20f531897a8fb88816dc22fe990045a
SHA512 4f3981377a76468a86b8a7bc1493e3a17e34195109357d3b129c49fde8ca34f05a79eb494d1dacad52a5e44a3465b0159a43190c2fc39d78250d01513c0289fd
SSDEEP 384:KMVoJSl2AhayvRvISg6APev12TNDqhiPRH:KBSlpfRvLUWv12ki
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnf.exe

Path C:\Windows\Temp\dnf.exe
Size 41KB
SHA256 eef0838190ae76424293ffcc17f46cef7529ac91fa1949d1bfe7d52e43a306fd
MD5 7307bb8607026b4cfbe82ea7abc0165c
SHA1 2e54ed21c8438e16a4d253fd7cf3ab7665a2e73b
SHA512 8e8d0826bf756b26d301c216bf95a83498dc05c27945ccd71ac27d8c82b08c23a1e1c256c1b95b520928507f9305b4664b150ce519e9115696e64ddbe79c0c75
SSDEEP 768:Nl0nADLiLqGuUBnNmpGrU+EXtb9XIJE7HwIdO1aFpB8uIAXaKhhAGdfTmnf:vqmehueUVtb9NDwI41IB1IpPGdCn
MD5 SHA1 SHA512 SSDEEP

Submit Download

panlong.exe

Path C:\Windows\Temp\panlong.exe
Size 412KB
SHA256 ce3f8cba4fe408e6f1c9ddebaa7523fe361ac494fe95ba83bdd202c457fd0963
MD5 e28cb009daf185fd3176045f4005b787
SHA1 a0816a05b531e590d91e29bf84f0fcba90a0ca22
SHA512 88e3f179655d8ced7e83a2674f585abba481157ffdee9014c5d9deca7d52bd90cd624c7b94f663752743c64c9a1648947e97a49e5cbc8e4536383ac748243238
SSDEEP 12288:5NIQAPGsAqY9IMVYd38sJdpQHlGlY8KfTi:uPGSY91VwNJcFMqTi
MD5 SHA1 SHA512 SSDEEP

Submit Download

~324.tmp

Path C:\Windows\~324.tmp
Size 32KB
SHA256 1468bbbff266632c4445e68075dfecd8a4198c89715539f370adc309734a9350
MD5 c203cfb9f4d79c9f83fee7419f2eba0f
SHA1 74babcae8df306cb30515c3537e14ec6cbdad279
SHA512 58069a5f8b0fb9253bdb9462745bc81cbc500104c2c44edfbaef5f67d8dd5c5918ca70354365fc517dc7af11746fb107536e436b57044b68418bf04e1a79a7be
SSDEEP 384:hn3Eot7OZn4pBZFbjlKlbdMRPoNQMDjYWwUueDqEZeSp/fN7W:yotiZ2BoZdnjYWwu7eSpN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/708-45-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/708-61-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/780-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/780-55-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/780-9-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3948-57-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3948-17-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4664-50-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4664-36-0x0000000000400000-0x0000000000410000-memory.dmp

Download