e1f41237f1d1c86715432ade9d7d80f963a77cc83383a5d68fadda0f246c5ecf

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1f41237f1d1c86715432ade9d7d80f963a77cc83383a5d68fadda0f246c5ecf.exe
Size

390KB
MD5

52a06ad86bc5107b2dc82ddb19b114de
SHA1

a904f4063ec9b7d20073d05c0475140d5c77c5e9
SHA256

e1f41237f1d1c86715432ade9d7d80f963a77cc83383a5d68fadda0f246c5ecf
SHA512

4478ed04627500d073c353a5cd0545f9f2bfdff8e60722f2f74e9acff2f40b91ac8968248c83369a9eff32853e181a6e27450caa1d70e331a2e093bcd9984c83
SSDEEP

3072:NlYwDUWyFcB9fu+JMl2uU82Ws7f9sjboPACTQembG4hWp:NlfD1Yc7GIBgbzjbfLh2

Score

9^/10

persistence

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 3 IoCs

resource	yara_rule
behavioral1/memory/2456-0-0x0000000000400000-0x0000000000466000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000b0000000155e2-7.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2576-9-0x0000000000400000-0x0000000000466000-memory.dmp	INDICATOR_EXE_Packed_MPress

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2576	tbckyxk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tbckyxk.exe	e1f41237f1d1c86715432ade9d7d80f963a77cc83383a5d68fadda0f246c5ecf.exe
File created	C:\PROGRA~3\Mozilla\newtrln.dll	tbckyxk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2576	2956	taskeng.exe	29
PID 2956 wrote to memory of 2576	2956	taskeng.exe	29
PID 2956 wrote to memory of 2576	2956	taskeng.exe	29
PID 2956 wrote to memory of 2576	2956	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\e1f41237f1d1c86715432ade9d7d80f963a77cc83383a5d68fadda0f246c5ecf.exe
"C:\Users\Admin\AppData\Local\Temp\e1f41237f1d1c86715432ade9d7d80f963a77cc83383a5d68fadda0f246c5ecf.exe"
1⤵
- Drops file in Program Files directory
PID:2456

C:\Windows\system32\taskeng.exe
taskeng.exe {A8103DEB-FCB2-43C9-BF9F-9CA47C2156CB} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\PROGRA~3\Mozilla\tbckyxk.exe
  C:\PROGRA~3\Mozilla\tbckyxk.exe -gqpcbye
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\tbckyxk.exe

Filesize
390KB

MD5
2d8ef52f5534e0f263e4175839e0277a

SHA1
52222114e16e854a946aa18b7bb84a45062e6f27

SHA256
9f541da6f6f9be46582dfa04f90c4fb5a5d02b64db88e69e6646a2e6ec4d3715

SHA512
e3da7abcebdef821968f66683e4380fed3763158e6033c4287286bc1466c69f80cdbbf13f76b0a87e48565381d06e4c94aa4a5a194572ba0c930cd3aa8d11a97

Download Submit
memory/2456-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2456-4-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2456-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2576-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2576-10-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2576-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download