2854ef18b052f7b19e9ef1f006508e87f1ee3ed2592eef1aa9bb7d941852c3ca

max time kernel
143s
max time network
161s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
12-04-2024 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
Size

1.9MB
MD5

456dad1f25fefa40f70c152a706316bc
SHA1

c741c8e32f1510c175c6d518401f3cf4d4f6d8da
SHA256

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412
SHA512

e51d7f476d0b92cef1d2bc012f9436aead835642381241ba6d2dd149251a3ccc09b28e0be160e1e8f62aa6da79b935a6016700e31605895042c1fe61b4ca876f
SSDEEP

49152:F/MBkUJZCcifDFu/6nEkqg1kka+dW0hWk9NQXNF+9uop3biUIgYcoP:FEBkmZofDFu/6nR6SW+woVBlR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2840-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-13-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-19-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-35-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-41-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2840-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 62.102.148.68

description	ioc
Destination IP	62.102.148.68

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 3272 set thread context of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

pid	process
2840	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2840	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2840	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2840	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2840	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
2840	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

description	pid	process	target process
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
PID 3272 wrote to memory of 2840	3272	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe	67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe
"C:\Users\Admin\AppData\Local\Temp\67d39d9194a79f2f1aa0585b8cbc3a38a651964d72469e27692a62038ae3b412.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.7MB

MD5
27acfbf94480631e547b5cb508d9d4fb

SHA1
f6477330ca9aeb4a8cd19cc44e1a30fa9695b36c

SHA256
0fd156526952ba5edb62133774a19bf72f71d3c968d01fcdb517521d45a67c5e

SHA512
902ccecfa284881c1f241802b9ccd51a85da0cc48632fbd944b686d37a4fa57bc7cd01c44ef79bfe475494be780164b82ff8fa9a3e77984f6e29467843138929

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
13.8MB

MD5
0d68b42ebdbcc0b067602a2d2ad5bb2d

SHA1
47bd381aa7f858ac142788f814ec623c9bf76e36

SHA256
314ad03bd40e2579a38f5e2ad03868e3997a00be7b42efe6da82b361f6d85632

SHA512
d5b1feae7f382e7a3d42723baaee2c402593ee9b1463a83c37445773e55f2e80e7098b5d18bfeac4d3683d6931a97990112f5d4013d24c8763875fd9c38e833e

Download Submit
memory/2840-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-13-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-31-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-19-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-35-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-41-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2840-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3272-3-0x0000000002480000-0x0000000002637000-memory.dmp

Filesize
1.7MB

Download
memory/3272-1-0x0000000000920000-0x0000000000ADF000-memory.dmp

Filesize
1.7MB

Download