564ba6fcc511c27a19bf6d4de9dafb696f43f11071c452899ac8c71877d0e33b

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

564ba6fcc511c27a19bf6d4de9dafb696f43f11071c452899ac8c71877d0e33b.exe
Size

260KB
MD5

9408b0a8fd703847ad43ac6f6b2053f7
SHA1

bfa65b7d850ab03d2654784b8d1846665aa7f7bf
SHA256

564ba6fcc511c27a19bf6d4de9dafb696f43f11071c452899ac8c71877d0e33b
SHA512

d00e1de744fceef97388ff4f4eadf42cd547a069783cc98deb9ebd47b8a55159d6103b6a0a0f01993c4ddf9a6f0a9b35851ae62448962e6196188e32e43d4699
SSDEEP

6144:2Kp+kqKt7gZ3qTFbIyVWeU2xnbkytg2MBTR/rW:2Kp+k7dgVqRJVZxnIyi2MT9q

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral1/memory/3044-7-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral1/files/0x00040000000130fc-8.dat	UPX
behavioral1/memory/2524-10-0x0000000000400000-0x000000000042D000-memory.dmp	UPX
behavioral1/memory/2524-17-0x0000000000400000-0x000000000042D000-memory.dmp	UPX

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2524	nhadrjb.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/3044-7-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00040000000130fc-8.dat	upx
behavioral1/memory/2524-10-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2524-17-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nhadrjb.exe	564ba6fcc511c27a19bf6d4de9dafb696f43f11071c452899ac8c71877d0e33b.exe
File created	C:\PROGRA~3\Mozilla\mrcfdgn.dll	nhadrjb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2524	2248	taskeng.exe	29
PID 2248 wrote to memory of 2524	2248	taskeng.exe	29
PID 2248 wrote to memory of 2524	2248	taskeng.exe	29
PID 2248 wrote to memory of 2524	2248	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\564ba6fcc511c27a19bf6d4de9dafb696f43f11071c452899ac8c71877d0e33b.exe
"C:\Users\Admin\AppData\Local\Temp\564ba6fcc511c27a19bf6d4de9dafb696f43f11071c452899ac8c71877d0e33b.exe"
1⤵
- Drops file in Program Files directory
PID:3044

C:\Windows\system32\taskeng.exe
taskeng.exe {F0EE3316-A3C5-4FF2-A8AC-4325864F24D6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\PROGRA~3\Mozilla\nhadrjb.exe
  C:\PROGRA~3\Mozilla\nhadrjb.exe -giukxrm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nhadrjb.exe

Filesize
260KB

MD5
ba834989f9b6ea38224175f874db833a

SHA1
9d3690de9b2e416bf44c1d057666edf7299b437e

SHA256
dbbde34bfa6369324a4b2079ad5228185ae40dd60ee31af9a5803855f98c0e8e

SHA512
f8c3ec6200462af8a52280e71f5fcb4125b31d16372ab6a2b19056c8dbcced1cc583204c750de4735934322a1905a996ef71dd88d3be2d3670eb7c56955e1179

Download Submit
memory/2524-10-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2524-11-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/2524-17-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3044-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/3044-1-0x00000000002A0000-0x00000000002FB000-memory.dmp

Filesize
364KB

Download
memory/3044-7-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download