Resubmissions
12/04/2024, 14:40
240412-r19aqsec6y 1012/04/2024, 14:40
240412-r18n7sec6x 1012/04/2024, 14:36
240412-rylfwsbc28 1012/04/2024, 14:36
240412-rykvcsec4t 1012/04/2024, 14:36
240412-rykjlaec4s 809/04/2024, 07:38
240409-jgem1shg29 809/04/2024, 07:38
240409-jgdqqahg28 1009/04/2024, 07:38
240409-jgc47ada4y 1009/04/2024, 07:38
240409-jgctesda4v 825/12/2023, 04:54
231225-fjlybsahbr 7Analysis
-
max time kernel
1791s -
max time network
1807s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
09/04/2024, 07:38
General
-
Target
2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe
-
Size
1.9MB
-
MD5
59646583129acf5244d686f15aadb25a
-
SHA1
5b8b55dc12217eb37bd25ca61cd7aceec729e603
-
SHA256
2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250
-
SHA512
99a4c6612de866f966f2b9f84c16ada59d3606db942011d720debe12f4b059a9aec1b7c1046231b15ae728b6a27e616056588680aa3ebcbf0340a4d6eeddb9b2
-
SSDEEP
49152:Qe6RRRpEHQN/ThQrezxMQnXW8qaJZkRLagEoH6gFt:Q9nLEcrhhmYLwpbE+t
Malware Config
Signatures
-
Contacts a large (851) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 117443⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD55777d56460efb8519bcfe961647ffcc8
SHA1cb180d9885a517ec254c1fb7271e02de5bb3a73a
SHA256a10fc5dda3f349841a63877282650e21b6a4fd3176e48d607cbdbaaef5b1bd66
SHA512cdfd33d9d5ebf919431cd7a12f1b55137ab7005c69e2941c6e15ee081ecf2137ef4e272c4f40fbadd6f3c1b45f08aba31bc6ec0bd394f8fc3abf310cb64e7bbf
-
Filesize
11.4MB
MD5b2d71845fde7f58bde380d4fc21f473f
SHA1e7a3e8c9492157fd22ed333439910d0eaad3422b
SHA2568efa9f38f6f5469c6756f8fecc03f45e6371884eec71f36fdf1974ec689b2654
SHA512702dff66ec7726cc03a58dce01bd6f3fd4a322099708935c7c487fa44710f9134321045fddca281fdfcd5227d6d67db9328bf20b5d343291eac490c757a6fe50
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB