bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8

max time kernel
599s
max time network
600s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-04-2024 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
Size

1.9MB
MD5

bab406ad3b0603a45625755ffbccce49
SHA1

7ce0bd31c68c5b54854098acad195b7a8d804939
SHA256

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8
SHA512

a85ca2bc5ab42f8d32856a87c665b66df7d8e1c1ebbb143015d06fcc1bddba1faf684e2ee1d2a572f5ed04edf3a061837c293b5c1e3d2214864b90d8a68d25cc
SSDEEP

49152:hgWDef4IXn7EvfNf+x83OeG5ztpAEq2pe2n9SCtQV:hvo49fk83ONztiEqz2nA

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (747) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2652-1-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-27-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-28-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-29-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-55-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-84-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-90-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-79-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2652-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 1 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	pid	process	target process
PID 2324 set thread context of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

pid	process
2652	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2652	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2652	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2652	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2652	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
2652	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

description	pid	process	target process
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
PID 2324 wrote to memory of 2652	2324	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe	bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe

C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
"C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe
  "C:\Users\Admin\AppData\Local\Temp\bee5a8794014d11323dfb0276e541a0ee9567f61521a1a885ade5ca2d87f36d8.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
dab2b43a5160f05ac051521d8b3c9cb3

SHA1
68363d3e871099ff6d1a555e4c1c78bb8f15fb5d

SHA256
af4bb8cfd42af037db2ce687f858c9627e7dc9d953a46f8539c9cd6fa2e8eebc

SHA512
ad5a16746933b869d0e520bec027ff37cefd75c5add28ec8811bef0fffbe0126b6b44cb9c80c70dbe088bbbfb9e3a611bb1370189d8978793cbeb36ea9873211

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
5.9MB

MD5
78eb19f3ec3a59c242398fca2c22524f

SHA1
43d17507012bb74c43d8c9681ac308f4a380d5a1

SHA256
1701b24aa3fca1d88f01479b42637a5770a8c2c489dca90d315b5ba10d74407a

SHA512
5d659228dd5afc08a24c57cc36bb795c7aea2bcbdcfa2c47af09a6959d4b6d21146ea9275427b563b62ee6c7a3d3651ec04b82c3e815003e5398e9739a165f73

Download Submit
memory/2324-2-0x0000000002500000-0x00000000026B9000-memory.dmp

Filesize
1.7MB

Download
memory/2324-4-0x00000000026C0000-0x0000000002877000-memory.dmp

Filesize
1.7MB

Download
memory/2652-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-27-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-28-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-29-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-1-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-55-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-90-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-84-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-79-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2652-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download