0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b

max time kernel
300s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
Size

1.9MB
MD5

1543d5f2bf658fb837d5aabf4c81d6c1
SHA1

f7d25bba549095a63e75174a6318aae83fca1326
SHA256

0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b
SHA512

569d08943cf4e12a0f87d01760f8aa60cf20cb846f49724ee827585f6670f33f3dc3e088e453ec2bb9f490b66d1a16153c435d9f7cb9ffab98cf23c481227e36
SSDEEP

49152:gWRJu3Kbha03xUDhZSG5JgFCDT72+yZR64ooyHWUUz7fY0vE:gdU/WDhc7FNZR/h3

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/1936-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-13-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-38-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-95-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-110-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-108-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1936-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	62.102.148.68

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1936	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
1936	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
1936	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
1936	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
1936	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
1936	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78
PID 5060 wrote to memory of 1936	5060	0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe	78

C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
"C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
  "C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus

Filesize
2.6MB

MD5
9bae03d3dc0f5cfd40507ee03ba5a765

SHA1
bbb2ea791c2e53e615f7c4b17246b4d465e6a4fe

SHA256
ff1af3cc0eff747f5425287eea2910d8d69cd9d30af5a90a41a03a023bb0313f

SHA512
2263b74eefd835f92a085f1b35e156b79c37996b1976d6b93ad94cfce8454411131d4b3dc1d3d3cee175b37d05433f3061060023219d7d3da86e034e510b7b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
6.0MB

MD5
30cc4bce85cb9201f2094b56031f344d

SHA1
330f98cb5443017c5b788acd10d12c39cb7047de

SHA256
49df8651d0355ce6e2578d5bae5075926e45c308b89f9d2faa7e91b1a77f6c46

SHA512
1574e912950884888d150af9eecc8cfb18bca6da8b5037bd98c50fb93acd300921a2712c1323046141f02524c5e954c85c663ed2498c5ebd344d746e5520e02b

Download Submit
memory/1936-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-13-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-31-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-38-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-95-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-110-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-108-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1936-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/5060-1-0x0000000002A80000-0x0000000002C42000-memory.dmp

Filesize
1.8MB

Download
memory/5060-2-0x0000000002C50000-0x0000000002E07000-memory.dmp

Filesize
1.7MB

Download