bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35

max time kernel
151s
max time network
604s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
Size

1.9MB
MD5

97e5f2c04baad060d0169b7d76cfa5de
SHA1

00d5d0699bf1ccddf28fbd9eeb6ed9aaa8bc320b
SHA256

bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35
SHA512

56fabb8ec6be3cdb582214c9519a3ae59d4b4d0e97262c646cdbc6ac54d0f0fddb692e5fbebb6589ce2e63cae4f4567812aa911765431d95d412d4a86de82e9f
SSDEEP

49152:gFnov1UndgBEDJnUJFLIzBAxmOcgSp/QDsYiX:MnovedqGoWFAxP2QHi

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/928-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-13-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-20-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-32-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral3/memory/928-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
122	discord.com
129	discord.com
177	discord.com
340	discord.com
480	discord.com
632	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1424 set thread context of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
928	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
928	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
928	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
928	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
928	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
928	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92
PID 1424 wrote to memory of 928	1424	bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe	92

C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
"C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe
  "C:\Users\Admin\AppData\Local\Temp\bb50ae148cf4986c2ac4c81e75412a91910fe8fb169bd054d130a775af4b5e35.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2256,i,18272763564106695635,11201593968620719822,262144 --variations-seed-version /prefetch:8
1⤵
PID:7312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
9bae03d3dc0f5cfd40507ee03ba5a765

SHA1
bbb2ea791c2e53e615f7c4b17246b4d465e6a4fe

SHA256
ff1af3cc0eff747f5425287eea2910d8d69cd9d30af5a90a41a03a023bb0313f

SHA512
2263b74eefd835f92a085f1b35e156b79c37996b1976d6b93ad94cfce8454411131d4b3dc1d3d3cee175b37d05433f3061060023219d7d3da86e034e510b7b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
6.6MB

MD5
7ec1c7889924f0d3e363d2b6e1ba9285

SHA1
64f60231eb47a4c4ce8ecce13ea64dff702d2df7

SHA256
219b0a7329e1d0b2a75346c66d5433d7111f26b0f0448a3d99325cfc4bd13c27

SHA512
43236b25fd9cd655598424e881b29706c8bd8f35d65ee76a33094d3dd08584b840a0f15ca20dab94f72273015b3cb4d98bf21fd2c5c2d0482f7cb428d504ff1f

Download Submit
memory/928-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-13-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-20-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-32-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/928-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1424-1-0x0000000002A60000-0x0000000002C19000-memory.dmp

Filesize
1.7MB

Download
memory/1424-2-0x0000000002C20000-0x0000000002DD7000-memory.dmp

Filesize
1.7MB

Download