bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35

max time kernel
279s
max time network
303s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/04/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
Size

1.9MB
MD5

97e5f2c04baad060d0169b7d76cfa5de
SHA1

00d5d0699bf1ccddf28fbd9eeb6ed9aaa8bc320b
SHA256

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35
SHA512

56fabb8ec6be3cdb582214c9519a3ae59d4b4d0e97262c646cdbc6ac54d0f0fddb692e5fbebb6589ce2e63cae4f4567812aa911765431d95d412d4a86de82e9f
SSDEEP

49152:gFnov1UndgBEDJnUJFLIzBAxmOcgSp/QDsYiX:MnovedqGoWFAxP2QHi

Score

10^/10

discovery persistence upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
kevaind.org
Port:
21
Username:
[email protected]
Password:
knl123

Extracted

Credentials

Protocol: ftp
Host:
kevaind.org
Port:
21
Username:
7144163
Password:
knl123

Extracted

Credentials

Protocol: ftp
Host:
kevaind.org
Port:
21
Username:
admin
Password:
knl123

Extracted

Credentials

Protocol: ftp
Host:
kevaind.org
Port:
21
Username:
kevaind
Password:
knl123

Signatures

Contacts a large (749) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3644-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-112-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-110-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-111-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-109-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/3644-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3644	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
3644	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
3644	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
3644	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
3644	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
3644	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74
PID 4496 wrote to memory of 3644	4496	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	74

C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
"C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
  "C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
9bae03d3dc0f5cfd40507ee03ba5a765

SHA1
bbb2ea791c2e53e615f7c4b17246b4d465e6a4fe

SHA256
ff1af3cc0eff747f5425287eea2910d8d69cd9d30af5a90a41a03a023bb0313f

SHA512
2263b74eefd835f92a085f1b35e156b79c37996b1976d6b93ad94cfce8454411131d4b3dc1d3d3cee175b37d05433f3061060023219d7d3da86e034e510b7b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
8.8MB

MD5
5309aec661dd19151e3b1de60df233bf

SHA1
26895a19bef5c3bd10b21ff4b07e53f06565513c

SHA256
f01cbeee41ea8132c3b402697785118d088627713ecb7a2577230a524a83cabd

SHA512
336cb5666651f80e8594766d3d1e22fabbba7e1e6b2990161b58cd82efe74d35e0e5c549782d211f21ac43447f089a3a0835d2a9fe60d936f3520f905b90d6f3

Download Submit
memory/3644-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-23-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-109-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-112-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-110-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3644-111-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4496-3-0x0000000002AB0000-0x0000000002C67000-memory.dmp

Filesize
1.7MB

Download
memory/4496-1-0x0000000002780000-0x0000000002947000-memory.dmp

Filesize
1.8MB

Download
memory/4496-31-0x0000000002780000-0x0000000002947000-memory.dmp

Filesize
1.8MB

Download