Resubmissions
09-04-2024 13:04
240409-qbet6aff89 1009-04-2024 13:04
240409-qbd8maff88 809-04-2024 13:04
240409-qbdl4aah8z 1009-04-2024 13:04
240409-qbdbbsff87 7Analysis
-
max time kernel
99s -
max time network
268s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 13:04
Static task
static1
Behavioral task
behavioral1
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win11-20240221-en
General
-
Target
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
-
Size
1.9MB
-
MD5
57c833bfd5042e34bec23dfd711cd151
-
SHA1
6bcd1915173d57d369e209943be31eebebdd535a
-
SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
-
SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
SSDEEP
49152:JpOMJqAtfj8YFWZUQUqxbhS+oWOKl9BoKzLPGz+fATq:BJqaj8S8zUqx0xW1KKzLP8w
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2356-5-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-6-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-8-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-9-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-10-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-11-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-16-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-17-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-18-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-28-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-39-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-46-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-52-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-53-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-54-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-58-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-62-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-63-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-64-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-67-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-71-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-76-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-81-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-85-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-92-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-99-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-108-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-107-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-106-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-105-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-103-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-102-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-101-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-98-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-96-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-93-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-90-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-89-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-87-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-84-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-83-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-80-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-78-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-77-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-75-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-72-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-70-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral1/memory/2356-69-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exedescription pid process target process PID 2280 set thread context of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exepid process 2356 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 2356 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 2356 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exedescription pid process target process PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 2280 wrote to memory of 2356 2280 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmpFilesize
2.6MB
MD5cc74fe855429ddc5afd0492c81a99ed3
SHA19f01e7f41fe661b9d0ea01b5618d3ca142e0e9c8
SHA256d4244a317932d44c7cdc64bf716a1452c61bfafd28b8ab0fa85fb785725e8dbc
SHA5124a11e0b81b9714e42841ff7744a1baedc8396589cd275ce0627502c5e9582ecdb279602325c01a07616d5d1e4c635ae9aa12353e3273c310e735c480a3f9c442
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
14.2MB
MD5c6be076ff3fb595e0854aa5045f3163d
SHA1bdfb39a272572af81d1899eb4deef394e3786fbb
SHA256015ca0389a985f5c6977433b15c53abe9f93e82c84c3b0dbf621c72b15cf6a31
SHA512b2003c15a29954678505f354c8b44018fe552c2304b33bc88d56534b3a3796b95476f1902dce0bce638e16360b73f668c08f6d6d1c7809210cf6dc21dcbceda6
-
memory/2280-2-0x0000000002170000-0x0000000002328000-memory.dmpFilesize
1.7MB
-
memory/2280-4-0x0000000002330000-0x00000000024E7000-memory.dmpFilesize
1.7MB
-
memory/2280-0-0x0000000002170000-0x0000000002328000-memory.dmpFilesize
1.7MB
-
memory/2356-71-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-17-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-9-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-10-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-11-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-16-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-18-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-28-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2356-99-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-46-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-52-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-53-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-54-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-62-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-67-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-39-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-108-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-107-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-106-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-105-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-103-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-102-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-101-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-93-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-89-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-84-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-75-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/2356-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB