7b5a28146cf2884c39e62a69c61931c6a485ca629410902e53d953ec53b2b7a2

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b5a28146cf2884c39e62a69c61931c6a485ca629410902e53d953ec53b2b7a2.exe
Size

221KB
MD5

92373746b48cb18d57ac9f3caffc0f7d
SHA1

c938e13943df7a59ade5922a2858a90929054815
SHA256

7b5a28146cf2884c39e62a69c61931c6a485ca629410902e53d953ec53b2b7a2
SHA512

9e9579482382a21843cb405fa86f5b690aa01a20f71b3fd269982df428fb8e5c58c4aa18d610d86abf332ca5b9a6b32095f07f6d52042d678fa8643c23ef25a5
SSDEEP

3072:EaM74bUOTAjzX7qZ8lUJq8qallDmNcB2xwD8q1JFFGAXfUCXHSRckb5c2gL:544b7czqmlKa08qvFsRcTH

Score

9^/10

persistence

Malware Config

Signatures

Detects executables packed with ASPack 2 IoCs

resource	yara_rule
behavioral2/memory/1532-0-0x0000000000400000-0x000000000045E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b000000023114-5.dat	INDICATOR_EXE_Packed_ASPack

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2984	gfuniul.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\gfuniul.exe	7b5a28146cf2884c39e62a69c61931c6a485ca629410902e53d953ec53b2b7a2.exe
File created	C:\PROGRA~3\Mozilla\kzlcazd.dll	gfuniul.exe

C:\Users\Admin\AppData\Local\Temp\7b5a28146cf2884c39e62a69c61931c6a485ca629410902e53d953ec53b2b7a2.exe
"C:\Users\Admin\AppData\Local\Temp\7b5a28146cf2884c39e62a69c61931c6a485ca629410902e53d953ec53b2b7a2.exe"
1⤵
- Drops file in Program Files directory
PID:1532

C:\PROGRA~3\Mozilla\gfuniul.exe
C:\PROGRA~3\Mozilla\gfuniul.exe -lfdzfzd
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\gfuniul.exe

Filesize
221KB

MD5
df2c7d1c185ce885ba2b54394a604efe

SHA1
43585785c79a13575252d0359c5111ca002debcd

SHA256
a219d977f1e4cf950355f13e7630d14d67c333dd5f188552ef1c81e64a1398ad

SHA512
0f07cab1620cb63433618cbba8019a1783458e63c2c2830afeaaf2a871d61696cad68f5132a2288b5cfd3495e1c692a9ea5a8aa2820027965147417603507dcd

Download Submit
memory/1532-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1532-1-0x00000000021E0000-0x000000000223B000-memory.dmp

Filesize
364KB

Download
memory/1532-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1532-6-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2984-8-0x0000000000600000-0x000000000065B000-memory.dmp

Filesize
364KB

Download
memory/2984-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2984-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download