2c00460fb294b93f4d4675d47b3d6a9064fda1b23a2493181f7f9ae82c7fee80

Analysis

max time kernel
142s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df98bf0787c847eda952aa050c47ec3d.exe
Size

33KB
MD5

df98bf0787c847eda952aa050c47ec3d
SHA1

671f6e5d1cfe96f35ae7f4139a26127e8f581654
SHA256

2c00460fb294b93f4d4675d47b3d6a9064fda1b23a2493181f7f9ae82c7fee80
SHA512

ce1535845114a6373fb759105bf0a1cb0f79f111ba76f06dc24ceece5dc115e0d803d59b81966a1866650f8c5eff26d783336871231118dc087bb2e0c739d2ff
SSDEEP

768:7kvk6dsQ08wOEFPRxOYU9AER1o4YNAq9fZY13sX52ynhBx9MW:7OWrrU7A4YNvG18XlL93

Score

8^/10

evasion upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
4088	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4088	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1432-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral2/memory/1432-12-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msimg32.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\dllcache\msimg32.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\yuksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File opened for modification	C:\Windows\SysWOW64\yuksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\yumidimap.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\yumsimg32.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\sysapp5.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\ksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\dllcache\ksuser.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\midimap.dll	df98bf0787c847eda952aa050c47ec3d.exe
File created	C:\Windows\SysWOW64\dllcache\midimap.dll	df98bf0787c847eda952aa050c47ec3d.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4540	sc.exe
3968	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1432	df98bf0787c847eda952aa050c47ec3d.exe
1432	df98bf0787c847eda952aa050c47ec3d.exe
1432	df98bf0787c847eda952aa050c47ec3d.exe
1432	df98bf0787c847eda952aa050c47ec3d.exe
1432	df98bf0787c847eda952aa050c47ec3d.exe
1432	df98bf0787c847eda952aa050c47ec3d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	df98bf0787c847eda952aa050c47ec3d.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2972	1432	df98bf0787c847eda952aa050c47ec3d.exe	89
PID 1432 wrote to memory of 2972	1432	df98bf0787c847eda952aa050c47ec3d.exe	89
PID 1432 wrote to memory of 2972	1432	df98bf0787c847eda952aa050c47ec3d.exe	89
PID 1432 wrote to memory of 3968	1432	df98bf0787c847eda952aa050c47ec3d.exe	90
PID 1432 wrote to memory of 3968	1432	df98bf0787c847eda952aa050c47ec3d.exe	90
PID 1432 wrote to memory of 3968	1432	df98bf0787c847eda952aa050c47ec3d.exe	90
PID 1432 wrote to memory of 4540	1432	df98bf0787c847eda952aa050c47ec3d.exe	91
PID 1432 wrote to memory of 4540	1432	df98bf0787c847eda952aa050c47ec3d.exe	91
PID 1432 wrote to memory of 4540	1432	df98bf0787c847eda952aa050c47ec3d.exe	91
PID 1432 wrote to memory of 4088	1432	df98bf0787c847eda952aa050c47ec3d.exe	94
PID 1432 wrote to memory of 4088	1432	df98bf0787c847eda952aa050c47ec3d.exe	94
PID 1432 wrote to memory of 4088	1432	df98bf0787c847eda952aa050c47ec3d.exe	94
PID 2972 wrote to memory of 2456	2972	net.exe	96
PID 2972 wrote to memory of 2456	2972	net.exe	96
PID 2972 wrote to memory of 2456	2972	net.exe	96

C:\Users\Admin\AppData\Local\Temp\df98bf0787c847eda952aa050c47ec3d.exe
"C:\Users\Admin\AppData\Local\Temp\df98bf0787c847eda952aa050c47ec3d.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\net.exe
  net stop cryptsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop cryptsvc
    3⤵
    PID:2456
- C:\Windows\SysWOW64\sc.exe
  sc config cryptsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3968
- C:\Windows\SysWOW64\sc.exe
  sc delete cryptsvc
  2⤵
  - Launches sc.exe
  PID:4540
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\1711470387.dat, ServerMain c:\users\admin\appdata\local\temp\df98bf0787c847eda952aa050c47ec3d.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1711470387.dat

Filesize
32KB

MD5
740b2961d5bd98d0ef28544eb0d62781

SHA1
94209f84f84d645c4dc73ba02b3bbb0b9c22ee91

SHA256
9f2413bfe9661dd59fb1574c9dcf9868abc5b432ff56c862b3f47f5cd41eb9ee

SHA512
fcd57e183903f99e0134182b4bad3a94256141869a7501cd63f702f9d1f85971818ca26ff71a584e4c432b4731c9630171664db82be62403a1ba9aa8d6e88e77

Download Submit
memory/1432-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1432-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download