1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
Size

60KB
MD5

746a9c8d2aecc7edb488b65b4ac7e29d
SHA1

9d8d92fa000f7a8a99ab97ff473f8e60d18a7c0f
SHA256

1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db
SHA512

760bf3e0a1a53701feb41f3ed4996074e1f210ec99b7727ed9b7a313edc747e20be368fa5d9400b37bff367a79732ebd1bb06af33da2a1c4a94f05a04d9dd006
SSDEEP

1536:rg2j6bIGspbnBzssXeP3O9HLyMphMswyuyzVAGeOwT:N6MLpbBosXePe9HWMJlum07T

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000458000-memory.dmp	UPX
behavioral1/files/0x002a000000013a88-6.dat	UPX
behavioral1/memory/2472-14-0x0000000000400000-0x0000000000458000-memory.dmp	UPX
behavioral1/memory/2240-12-0x0000000002C20000-0x0000000002C78000-memory.dmp	UPX
behavioral1/memory/2240-17-0x0000000000400000-0x0000000000458000-memory.dmp	UPX
behavioral1/memory/2472-19-0x0000000000400000-0x0000000000458000-memory.dmp	UPX

Deletes itself 1 IoCs

pid	Process
2472	Systeamambic.exe

Executes dropped EXE 1 IoCs

pid	Process
2472	Systeamambic.exe

Loads dropped DLL 2 IoCs

pid	Process
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/files/0x002a000000013a88-6.dat	upx
behavioral1/memory/2472-14-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2240-12-0x0000000002C20000-0x0000000002C78000-memory.dmp	upx
behavioral1/memory/2240-17-0x0000000000400000-0x0000000000458000-memory.dmp	upx
behavioral1/memory/2472-19-0x0000000000400000-0x0000000000458000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe
2472	Systeamambic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2472	2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe	28
PID 2240 wrote to memory of 2472	2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe	28
PID 2240 wrote to memory of 2472	2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe	28
PID 2240 wrote to memory of 2472	2240	1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe	28

C:\Users\Admin\AppData\Local\Temp\1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe
"C:\Users\Admin\AppData\Local\Temp\1ca2452a638747fbe4bbbb66cf7640639b3e127cb1eb29ab1e786220befe97db.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\Systeamambic.exe
  "C:\Users\Admin\AppData\Local\Temp\Systeamambic.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cpath.ini

Filesize
102B

MD5
b37a42d465b79f1fafb175a7cb957424

SHA1
e131e5cce3919607378f9b46988deea8f4c13a8c

SHA256
41522ce0ac5f54440c4b41462257a145c63f43712e597eb10c24e1234a65a0ac

SHA512
f684bed103ce45abdbc9a4459b670e454e310ab13c0d3d545a6d24e2edbcefe69e4785ded1cb2e337df2c7b1141e61085e56a4bd92a3dabd107cf12f4817f9f2

Download Submit
\Users\Admin\AppData\Local\Temp\Systeamambic.exe

Filesize
60KB

MD5
a4e5645a275392f53875b278e7b37d8a

SHA1
e4e0180d54ffbaf2d1924c62055133abcac691d7

SHA256
53a40b2bff645bd68ea7847bc01cf54884d97af61ff4eca96ea7ef7cba93f050

SHA512
2170479946730c3dd6491ea976a4e92bf54bded026667b7b97e1d9495fedabc9fcfd985ede164cc9d8632901521c4af9e00d1fe516a4713d7fa0785fe9fc49f5

Download Submit
memory/2240-0-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2240-16-0x0000000002C20000-0x0000000002C78000-memory.dmp

Filesize
352KB

Download
memory/2240-12-0x0000000002C20000-0x0000000002C78000-memory.dmp

Filesize
352KB

Download
memory/2240-17-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2472-14-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2472-19-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download