2854ef18b052f7b19e9ef1f006508e87f1ee3ed2592eef1aa9bb7d941852c3ca

max time kernel
101s
max time network
303s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09-04-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
Size

1.9MB
MD5

456dad1f25fefa40f70c152a706316bc
SHA1

c741c8e32f1510c175c6d518401f3cf4d4f6d8da
SHA256

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412
SHA512

e51d7f476d0b92cef1d2bc012f9436aead835642381241ba6d2dd149251a3ccc09b28e0be160e1e8f62aa6da79b935a6016700e31605895042c1fe61b4ca876f
SSDEEP

49152:F/MBkUJZCcifDFu/6nEkqg1kka+dW0hWk9NQXNF+9uop3biUIgYcoP:FEBkmZofDFu/6nR6SW+woVBlR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/996-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-32-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-109-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-56-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/996-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1203 discord.com
1231 discord.com

flow	ioc
1203	discord.com
1231	discord.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 1448 set thread context of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

pid	process
996	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
996	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
996	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
996	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
996	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
996	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 1448 wrote to memory of 996	1448	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
  "C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus

Filesize
2.6MB

MD5
d4dfff132a935ecda7a5a6a32522a37f

SHA1
339a56e3e87ff64e3d956f1523b40087de3c4910

SHA256
1994d6d7b4f22815ab1b58cd593049f5139e9339de08f38cf152e546b2e329c2

SHA512
9d2aa6ff53076a59855e26076e75bcd802ad14b3791d8c57b9fa715d24d2decf76bd0cdbb0a25dd3616217a4419a12780914cdbf615c90084f86fbcc69ea130f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
8.4MB

MD5
88d53275eb215d948b498a0dd4515d65

SHA1
ddb7195fb2b6e9b71569cf3df15bcba5d7dddf62

SHA256
b6f9d34e4d9fa7ed44d244cbd7dbdc2df8d7f04d0ceed7d1727eb3a4a731bc96

SHA512
ba9c19091fe5636d3cfe5e508c3404d421bf9a2af23407c4018d6b2025fcaac7eddf55c0a2eead7dc968679b6079c67d2d9aa363562e889353a2bbd7ba0eecee

Download Submit
memory/996-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-32-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-109-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-56-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/996-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1448-1-0x0000000000AF0000-0x0000000000CB7000-memory.dmp

Filesize
1.8MB

Download
memory/1448-2-0x0000000002660000-0x0000000002817000-memory.dmp

Filesize
1.7MB

Download