5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338

Resubmissions

09/04/2024, 12:34

240409-przzlaac8s 8

09/04/2024, 12:26

09/04/2024, 12:26

09/04/2024, 12:26

09/04/2024, 12:26

Analysis

max time kernel
1793s
max time network
1800s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe
Size

2.0MB
MD5

800254df6a58674f74dad3b0b17567e9
SHA1

7b9d9ca917a8ea5d62e00b80b621ee20e477ee25
SHA256

5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338
SHA512

443079d87dea5c4c8275a11e140eb175ad60698fd56f911313aafeab3f55d30c6b4f153b2850fd09adff492a81d3187775fda9c4ac7c6f4aa8cf4605c4f83b0e
SSDEEP

49152:cvYYta34BRM4SHK9WIaI5X3r/qTYMp1WWENpf0T26H0/:CYYYooq9WIT3uTZpsNf0680

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1260-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-28-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-33-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-74-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-102-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/1260-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
120	discord.com
121	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1260	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe
1260	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe
1260	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28
PID 2056 wrote to memory of 1260	2056	5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe	28

C:\Users\Admin\AppData\Local\Temp\5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe
"C:\Users\Admin\AppData\Local\Temp\5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Users\Admin\AppData\Local\Temp\5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe
  "C:\Users\Admin\AppData\Local\Temp\5fd93568cca77dd27586dc4a1e0f02f59ec64e6807ee5e72aa04ae4d2bae2338.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
1e2769f7012387ea5b91b1e7c79ce55d

SHA1
88876090487a4e7e93ec3b6b70f78ba1ff3d37e0

SHA256
fb95200fe4c6f12b24a66f7febf24099ccb3bc7a8bd64fa4d368001418019306

SHA512
14dc40bb0166a01ac73bd53cf3f68dc7aff17e234e724814710b96a87eabbae3ee0edd0f3b8a0cedfd20f78ed5f75c32c56f69022d46869980a25134534bd6bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
6.0MB

MD5
7652f980993f33e9ad2076fc9e09f7a3

SHA1
b6b598b7ff8eb4ce5167eb68b67504f0a268c4c1

SHA256
f9772732ddbdf535a1059fca435f074da8834d93ee556c0666906a595fc587ef

SHA512
95a330cd96393522f85c9827c69d97af8f8ea52555a75f4bf0b942edbb40552ef4626c28df2af472268c054e24c3eb4138e20f84908c7522d8e9c4acca33e313

Download Submit
memory/1260-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1260-28-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-33-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-74-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-102-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1260-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2056-0-0x00000000045D0000-0x0000000004788000-memory.dmp

Filesize
1.7MB

Download
memory/2056-6-0x00000000045D0000-0x0000000004788000-memory.dmp

Filesize
1.7MB

Download
memory/2056-5-0x0000000004790000-0x0000000004947000-memory.dmp

Filesize
1.7MB

Download