7de1a314fffec5754d068c873def3e86dfb3f202059b3579128a9912eb75b62d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
Size

8.1MB
MD5

cac17fe5ebebfe851a9c9671ec2bbaca
SHA1

efe73a9e3c2c3dd2f7293b81d158249a4d963ebe
SHA256

46be2e0c81fc516a6076789930c53a29471fcc7fd184cdf878b2da5c2c517cac
SHA512

9ec7ce05dd6dc7c521e759a7e40ed477b2e3ae6ec69c84ad8d4f37d48a471bdd0e02bd90b889689343b43330bfd5a98287c189f37515e91c53d0153347be0d89
SSDEEP

49152:omf8odH3hb0t/XrpZi9qiijrsfGWhMBFvQALfmJlI0+s8KuqGaX0ToIBAUZLY6g:z8mXcpZQqDjwfhU9mJlI3JBAUZLq

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3216	setup_33_11002.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4584-2-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-14-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/4584-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4296	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3216	4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	96
PID 4584 wrote to memory of 3216	4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	96
PID 4584 wrote to memory of 3216	4584	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	96

C:\Users\Admin\AppData\Local\Temp\02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
"C:\Users\Admin\AppData\Local\Temp\02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\setup_33_11002.exe
  C:\Users\Admin\AppData\Local\Temp\/setup_33_11002.exe
  2⤵
  - Executes dropped EXE
  PID:3216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x4a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\setup_33_11002.exe

Filesize
694KB

MD5
371e59bf3e736ed4d0208dc4acd106d3

SHA1
a5cf12854db4d278e5451aa7b4ec2459f0d26d1d

SHA256
65b4ac4547ba560d2295007216e1215a825d076b3656f20d751f13bd7c2ba049

SHA512
a5aa61a2d43ac3ac9c50ab3ef1bde2f012e5138de3791fd6ed87d8c1eb1a5970131153c6074165d8eaf1cafc5d8fc470eb005ba94eac879964d75f27de94d1d2

Download Submit
memory/3216-62-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/3216-57-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/3216-56-0x00000000358C0000-0x00000000358D0000-memory.dmp

Filesize
64KB

Download
memory/4584-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-0-0x0000000000400000-0x0000000000C76000-memory.dmp

Filesize
8.5MB

Download
memory/4584-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-14-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/4584-2-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download