Resubmissions
09-04-2024 13:04
240409-qbet6aff89 1009-04-2024 13:04
240409-qbd8maff88 809-04-2024 13:04
240409-qbdl4aah8z 1009-04-2024 13:04
240409-qbdbbsff87 7Analysis
-
max time kernel
694s -
max time network
1197s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
09-04-2024 13:04
Static task
static1
Behavioral task
behavioral1
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Resource
win11-20240221-en
General
-
Target
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
-
Size
1.9MB
-
MD5
57c833bfd5042e34bec23dfd711cd151
-
SHA1
6bcd1915173d57d369e209943be31eebebdd535a
-
SHA256
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d
-
SHA512
3c14531cd81ac2276cac72da573cb5f452c53b96175acca025a8e30251c487fcd382a8bc25a5241e6700832dbb760313bf9e51ffa0fcd480d5ddc6662cbc02e1
-
SSDEEP
49152:JpOMJqAtfj8YFWZUQUqxbhS+oWOKl9BoKzLPGz+fATq:BJqaj8S8zUqx0xW1KKzLP8w
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/988-1-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-4-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-2-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-6-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-7-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-8-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-22-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-32-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-33-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-34-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-38-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-39-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-42-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-43-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-44-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-49-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-53-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-57-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-58-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-62-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-63-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-64-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-65-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-69-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-68-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-66-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-71-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-75-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-83-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-89-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-98-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-100-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-99-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-107-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-102-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-90-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-88-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-96-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-85-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-82-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-87-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-86-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-76-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-80-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-79-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-78-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-77-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-70-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-73-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-72-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-108-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-103-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/988-101-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 36 discord.com 38 discord.com 59 discord.com 134 discord.com 157 discord.com 333 discord.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exedescription pid process target process PID 3604 set thread context of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exepid process 988 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 988 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 988 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 988 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 988 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 988 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exedescription pid process target process PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe PID 3604 wrote to memory of 988 3604 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe 9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"C:\Users\Admin\AppData\Local\Temp\9d3c881c29156b8fd82ced7c7726c4c65d4e741533c9f886112f440698b1469d.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmpFilesize
2.6MB
MD5cc74fe855429ddc5afd0492c81a99ed3
SHA19f01e7f41fe661b9d0ea01b5618d3ca142e0e9c8
SHA256d4244a317932d44c7cdc64bf716a1452c61bfafd28b8ab0fa85fb785725e8dbc
SHA5124a11e0b81b9714e42841ff7744a1baedc8396589cd275ce0627502c5e9582ecdb279602325c01a07616d5d1e4c635ae9aa12353e3273c310e735c480a3f9c442
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
9.6MB
MD558ca5f5f4053721aca2ff4865fbc780c
SHA18667cd158ba25279c615544e48a5b6e0dd82b9ca
SHA2569b5493d3b300324f5c0bb425a9ba75b76ae3887dc46626c36413ae833b374ca8
SHA51250ffdc337e959bee703a15524b9ffc52ec63ac4986ccdc8ed725b7aa35f6ea97ad4ff8cbc341011e2f88f5502ed23400f0feac26085a56b4b0e7f5dc96bb9727
-
memory/988-1-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-4-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-2-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-7-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-22-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-32-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-33-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-34-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-38-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-39-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-42-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-43-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-44-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-49-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-53-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-62-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-65-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-68-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-66-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-71-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-75-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-89-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-100-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-99-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-107-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-102-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-88-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-86-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-73-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-108-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-103-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/988-101-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3604-3-0x0000000002610000-0x00000000027CC000-memory.dmpFilesize
1.7MB
-
memory/3604-5-0x00000000027D0000-0x0000000002987000-memory.dmpFilesize
1.7MB