Analysis
-
max time kernel
10s -
max time network
11s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-04-2024 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
qwcEjrHU5nu3zB9LKmGVuRne.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
General
-
Target
qwcEjrHU5nu3zB9LKmGVuRne.exe
-
Size
822KB
-
MD5
f29bb9918f3803046c2bab24c20b458d
-
SHA1
c162f42333a6a7ef23ea9fc17e470daece374b6c
-
SHA256
b84760ded0544c86d23849130082b99c3000b1e4ca5da0690fcdfbf2771b7993
-
SHA512
e9f27f3be82a4b32ad155067b5e7c8652ec2031321eec64574152f2ddb01ff20dc9f44ee75ff7c363b103e3d8a7952c013416f360527e969963a11dea023a164
-
SSDEEP
24576:OYHymN8tZiUqGvCBSYcjOaTKsB5Oih4un0:OYRNyZiUqwCgYWHhn
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
qwcEjrHU5nu3zB9LKmGVuRne.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe" qwcEjrHU5nu3zB9LKmGVuRne.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2516 schtasks.exe 2624 schtasks.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
qwcEjrHU5nu3zB9LKmGVuRne.exedescription pid process target process PID 1968 wrote to memory of 2516 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2516 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2516 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2516 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2624 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2624 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2624 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe PID 1968 wrote to memory of 2624 1968 qwcEjrHU5nu3zB9LKmGVuRne.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qwcEjrHU5nu3zB9LKmGVuRne.exe"C:\Users\Admin\AppData\Local\Temp\qwcEjrHU5nu3zB9LKmGVuRne.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:2516 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST2⤵
- Creates scheduled task(s)
PID:2624