Resubmissions
09-04-2024 13:37
240409-qwz1tsbf5w 709-04-2024 13:37
240409-qwzp3abf5v 709-04-2024 13:37
240409-qwy4jabf5t 909-04-2024 13:37
240409-qwyg1abf4z 805-03-2024 02:32
240305-c1nlpsch53 9Analysis
-
max time kernel
280s -
max time network
1208s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-04-2024 10:34
Static task
static1
Behavioral task
behavioral1
Sample
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Resource
win11-20240412-en
General
-
Target
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
-
Size
1.8MB
-
MD5
f41c9e6ca239395e71bcf027987282dc
-
SHA1
560a973e308f20e0dbe64a38eaeaa22285ced049
-
SHA256
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b
-
SHA512
cbf99c0e43b3a314ee6681f8655a269c0d51e4d40c10ea9c8571be30c5d69c0287c57be5b13e4fa7aecad7095efb4a741f1839dc9089251f41fa96f35011764a
-
SSDEEP
24576:h7OEqlRKCYqoxOMto8enhtiQkbx6zWXXfKfzZn00Eze2aP4sjagjotkEz4RaZMjM:h7B50L7fiQ26zEXfId0vFaQgMh4pj
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral4/memory/4768-3-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-5-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-6-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-7-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-8-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-9-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-26-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-35-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-36-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-38-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-45-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-49-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-50-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-51-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-57-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-58-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-59-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-60-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-61-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-62-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-63-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-64-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-65-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-69-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-70-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-74-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-75-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-77-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-78-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-76-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-80-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-81-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-82-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-79-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-87-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-83-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-84-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-85-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-88-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-89-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-95-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-90-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-91-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-92-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-94-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-96-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-98-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-93-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-99-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-100-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-104-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-105-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-110-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-107-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-103-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-112-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-113-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-114-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-115-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-116-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral4/memory/4768-108-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exedescription pid process target process PID 1000 set thread context of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exepid process 4768 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 4768 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 4768 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 4768 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 4768 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 4768 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exedescription pid process target process PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe PID 1000 wrote to memory of 4768 1000 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe 92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensusFilesize
2.7MB
MD59b2986911dd53fdda3a049f80e2fe4c8
SHA12e9e3f7bd2ed141fcedfd8c9caa787b04a96db67
SHA2561baf86a01a45e998d4e94c0c85c8bd5a7058693fe4587e2ada13eebec809ff2d
SHA51245e8cb3eeff3b2b2d3f0dd5f124fdf660698ccba9a346bcc502b7672bc65ca30f0fa507a4b69eb1dda7fe9b033b9abb1ea4a6d914c8b7b395a6220cf21af9187
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
11.0MB
MD5c0d0fdf3c1315891152660690e765898
SHA1be8624e811978f72a55cf1bf3271680d6568db99
SHA2565de5b9600712ac6851fa8b37838307c27f698d87ee60c82396e8b659559bf96f
SHA5129df050cd90e50152707f9d3a54cd0bcaab1bb6d5258875c2aea8f06d946857d2070736f26a482f6c66c211a8449619ebaa44384c88840442dac849bdc848ff3c
-
memory/1000-1-0x0000000003F00000-0x00000000040BC000-memory.dmpFilesize
1.7MB
-
memory/1000-2-0x00000000040C0000-0x0000000004277000-memory.dmpFilesize
1.7MB
-
memory/4768-3-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-7-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-9-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-26-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-35-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-36-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-38-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-45-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-49-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-50-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-51-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-59-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-60-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-61-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-62-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-65-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-74-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-75-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-84-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-88-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-89-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-95-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-91-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-94-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-93-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-99-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-100-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-104-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-105-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-110-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-107-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-103-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-112-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-113-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-114-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-115-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-116-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/4768-108-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB