34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359.exe
Size

449KB
MD5

86514d4ce7141e905dd47265bc59c8b4
SHA1

ebb24c2ce0b49344de67fae6a1d4fafc06343354
SHA256

34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359
SHA512

9fb2a3b3464b2f74e86b1705df1a952fa1c953594aae06affcde8e8158f5a544e0b65257612455bfe2019c837f9f3e404a60fb1737c1cb1d448d55654efdc6da
SSDEEP

12288:NJu6lfyi4fabr9jy4BNKOSuDVh+vh4tH1jo3rqsh2o:N8XfyhLNKQVhKutH1jo3Phl

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x000000000045F000-memory.dmp	UPX
behavioral1/files/0x000c000000015c16-6.dat	UPX
behavioral1/files/0x000c000000015c16-7.dat	UPX
behavioral1/memory/2524-8-0x0000000000400000-0x000000000045F000-memory.dmp	UPX

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2524	mgbxiii.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000400000-0x000000000045F000-memory.dmp	upx
behavioral1/files/0x000c000000015c16-6.dat	upx
behavioral1/files/0x000c000000015c16-7.dat	upx
behavioral1/memory/2524-8-0x0000000000400000-0x000000000045F000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\mgbxiii.exe	34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359.exe
File created	C:\PROGRA~3\Mozilla\iudaoda.dll	mgbxiii.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1976	34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359.exe
2524	mgbxiii.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2524	2936	taskeng.exe	29
PID 2936 wrote to memory of 2524	2936	taskeng.exe	29
PID 2936 wrote to memory of 2524	2936	taskeng.exe	29
PID 2936 wrote to memory of 2524	2936	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359.exe
"C:\Users\Admin\AppData\Local\Temp\34c03f5a3ffa8a6c119b1f59f535cef81f80f9a5541f33b0b9aa83d9c5446359.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1976

C:\Windows\system32\taskeng.exe
taskeng.exe {E50064A0-B0FB-4BA9-BBAD-088B07B7B3E9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\PROGRA~3\Mozilla\mgbxiii.exe
  C:\PROGRA~3\Mozilla\mgbxiii.exe -ccvrhxi
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\mgbxiii.exe

Filesize
69KB

MD5
a1b9505bea275cda0e69f81c68869ba7

SHA1
df8ed3007fd9a6fdc1cabb9a2b6639c05e753f1d

SHA256
da56844dee5f44018137df162dfda5d8dda41393839c60573c69660044c347c4

SHA512
4f77f77ea44e8c92c5f6733d86507484d247b38b22ab4b804f5a8fff7b5d6fda91a938f2062de8979adcbb55d6872d41e46369f59c5e09d3a190e02dc81cf3f9

Download Submit
C:\PROGRA~3\Mozilla\mgbxiii.exe

Filesize
449KB

MD5
7a35bc47ca53639b588a69ef99ec60a6

SHA1
ca1113cdc4afc4bb4242fe38b190baa90c24f936

SHA256
2107bd0cb36ffc3771d31766565c525ca8e931c81da6b89aa67345968dc1f64e

SHA512
be02ec178fa306393987bbfca6f9d88d34a174c5cb7bdf356fdbfa1861ff10dd88cf8c7a0e42d303600bee6988618e6fa9a2a785695fc854420607cb10a1eb2d

Download Submit
memory/1976-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1976-1-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/1976-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1976-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1976-5-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2524-8-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2524-9-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/2524-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2524-12-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download