Resubmissions
13/04/2024, 10:00
240413-l1wfzsff9v 913/04/2024, 10:00
240413-l1v58acg25 713/04/2024, 10:00
240413-l1nq5scg23 813/04/2024, 09:59
240413-l1gylacf99 713/04/2024, 09:59
240413-l1gb3acf98 709/04/2024, 08:20
240409-j8er4aad99 809/04/2024, 08:20
240409-j8egbsad98 809/04/2024, 08:20
240409-j8dvssad97 1009/04/2024, 08:19
240409-j8cyhadg4s 1026/02/2024, 04:47
240226-feyrbsdb58 8Analysis
-
max time kernel
1039s -
max time network
1801s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
13/04/2024, 10:00
General
-
Target
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe
-
Size
1.8MB
-
MD5
147f5f5bbc80b2ad753993e15f3f32c2
-
SHA1
16d73b4abeef12cf76414338901eb7bbef46775f
-
SHA256
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990
-
SHA512
9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6
-
SSDEEP
49152:L0F7w+ANy7moCOmY9x5VlLdf0w26/biK:IaXsCc9nmwfOK
Malware Config
Signatures
-
Contacts a large (870) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5cae53678af8227e6d6f022d6a856ddbd
SHA1802d2d2a25e1483d5b47e9d1a7b6865d6938efe8
SHA256893db0cada5e10fc6ba14944a6eaeb435cb12fc4c17a52fe5c9dd02a04591ff1
SHA512c4a6c660d11da9484f5bdfaaec4f5316b98fb84259f8f4f624b762a4f1f0cd4728291e9f1f39e6b9a26782ccf3d10003a8c210e29e06f4a48316243a227bd04a
-
Filesize
8.8MB
MD5d16ea7340153f4df20625a5c0a280f8a
SHA160f21520a70d38bd225e1a370f097550bfe210f9
SHA256cebbb41aaffa71fb24cdf3012ab8046df216aae6185984f3688907a017b70ce7
SHA512b516f19c1cd6e8dac75105718698d7cd901dd3826d7735da96e16a4fc40644d6f6991f4a7ac40b01d99195331107b5dfde05a2aca232029b682ba82bb90ad2a2
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB