Resubmissions
09-04-2024 13:04
240409-qbet6aff89 1009-04-2024 13:04
240409-qbd8maff88 809-04-2024 13:04
240409-qbdl4aah8z 1009-04-2024 13:04
240409-qbdbbsff87 7Analysis
-
max time kernel
395s -
max time network
602s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
09-04-2024 13:04
General
-
Target
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
-
Size
1.9MB
-
MD5
57c833bfd5042e34bec23dfd711cd151
-
SHA1
6bcd1915173d57d369e209943be31eebebdd535a
-
SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
-
SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
SSDEEP
49152:JpOMJqAtfj8YFWZUQUqxbhS+oWOKl9BoKzLPGz+fATq:BJqaj8S8zUqx0xW1KKzLP8w
Malware Config
Signatures
-
Contacts a large (1503) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
UPX packed file 51 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmpFilesize
2.6MB
MD5cc74fe855429ddc5afd0492c81a99ed3
SHA19f01e7f41fe661b9d0ea01b5618d3ca142e0e9c8
SHA256d4244a317932d44c7cdc64bf716a1452c61bfafd28b8ab0fa85fb785725e8dbc
SHA5124a11e0b81b9714e42841ff7744a1baedc8396589cd275ce0627502c5e9582ecdb279602325c01a07616d5d1e4c635ae9aa12353e3273c310e735c480a3f9c442
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
5.6MB
MD5dadd42d1839e73f5047b424b63b5cd54
SHA12f10af8e2fa890f8e1c48400e0f1f806fdd09b4f
SHA256ab0b56c6460821c977230efc428bb93ce16e7df104b0484d82293781f84bdb76
SHA5128179c9032f501aa783ef0bf83cf42dba079d9f8aa63ae9c5fdd2b95a4872b79a6ff6e39e792c2fd8b02bd2306059f17ce9ea3ff90bddcc7de2dc3d787b4dca31
-
memory/1888-68-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-95-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-7-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-15-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-22-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-23-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-24-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-25-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-4-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-31-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-46-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-49-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-50-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-54-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-55-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-60-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-66-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-1-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-75-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-67-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-89-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-93-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-99-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-102-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-100-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-97-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-103-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-104-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-105-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-94-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/1888-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4208-2-0x0000000002760000-0x000000000291C000-memory.dmpFilesize
1.7MB
-
memory/4208-3-0x0000000002920000-0x0000000002AD7000-memory.dmpFilesize
1.7MB