Resubmissions
13/04/2024, 10:00
240413-l1wfzsff9v 913/04/2024, 10:00
240413-l1v58acg25 713/04/2024, 10:00
240413-l1nq5scg23 813/04/2024, 09:59
240413-l1gylacf99 713/04/2024, 09:59
240413-l1gb3acf98 709/04/2024, 08:20
240409-j8er4aad99 809/04/2024, 08:20
240409-j8egbsad98 809/04/2024, 08:20
240409-j8dvssad97 1009/04/2024, 08:19
240409-j8cyhadg4s 1026/02/2024, 04:47
240226-feyrbsdb58 8Analysis
-
max time kernel
520s -
max time network
605s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
09/04/2024, 08:20
General
-
Target
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe
-
Size
1.8MB
-
MD5
147f5f5bbc80b2ad753993e15f3f32c2
-
SHA1
16d73b4abeef12cf76414338901eb7bbef46775f
-
SHA256
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990
-
SHA512
9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6
-
SSDEEP
49152:L0F7w+ANy7moCOmY9x5VlLdf0w26/biK:IaXsCc9nmwfOK
Malware Config
Signatures
-
Contacts a large (1512) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD521112c87b4bb2b0bb8004c1f1653d36e
SHA131aed7e1843c4cc528931710ba578f909e71d764
SHA256556b87267249b63a0e4ab4e0afd7924e88f72e036c55c1e18c40c7889762449c
SHA512b95c5603d090c79c8e67bd8f6f5cedffd2d0c5b1d453489d99733997ff2722d83a138c925790ed4341d61756f859ff5523ef54674553b6602b730a7042eccb2f
-
Filesize
6.9MB
MD514195f47802cdc265f8fde8a45e328e0
SHA144115015c50f965915f13d4f0fc15b7eb50edf55
SHA256ed7d77331e06a573bcb20e871b020037f0ec8bf49ab294eeb39e852cacdd29fc
SHA51285572402fabbf8ba2aea1cf41afa571b5ec2e29b4fcfab7d96daa6d7f77ce0ce0b4e5959084cfcc68c88ac8816018e4184c5463d9111a071683d53d5149eecdb
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1.8MB
-
Filesize
1.7MB