8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1

Resubmissions

17/04/2024, 12:30

240417-pprkfage31 7

17/04/2024, 12:30

17/04/2024, 12:30

17/04/2024, 12:29

17/04/2024, 12:29

16/04/2024, 13:40

Analysis

max time kernel
307s
max time network
1215s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
Size

1.9MB
MD5

30f046e1459ca02a1c2ac6fc6275092c
SHA1

8670f533c929445eb15d1e9939eaf58f47d39be3
SHA256

8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1
SHA512

dffb426dd1e7c67d6e5d31c8237c7138f78343946a0da2fb0785f5a8c6e200a56fd0d11ae4d6205fc39720141c178ecef55085e4ee39e7ff52ec6ac97a14d491
SSDEEP

49152:M6cHoIV5sg2a54Zi7O10no5YSDZnlJYmhPZh:dcL8g2pZOO10no5fDNT5PZh

Score

10^/10

discovery persistence upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ismery.fr
Port:
21
Username:
[email protected]
Password:
MangodesK318_

Extracted

Credentials

Protocol: ftp
Host:
ismery.fr
Port:
21
Username:
admin
Password:
MangodesK318_

Extracted

Credentials

Protocol: ftp
Host:
ismery.fr
Port:
21
Username:
[email protected]
Password:
N7ght!

Signatures

Contacts a large (747) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2360-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-10-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-11-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-12-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-29-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-37-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-51-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-63-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-65-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-71-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-69-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-64-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-94-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-99-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-86-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-82-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-105-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-108-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-109-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral2/memory/2360-110-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2360	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
2360	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
2360	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28
PID 2180 wrote to memory of 2360	2180	8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe	28

C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
"C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe
  "C:\Users\Admin\AppData\Local\Temp\8f142aa5fa506a316c7d3737ce7761ddb66f17227c8206b0d08c7de4724882a1.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
e7634067c1219da664e2c13a622988bf

SHA1
b354b3912ec59fefecdaa660af50c679b136b6ca

SHA256
e1f51b61149b811c5029caaa39ddf54faa18fcd18bbcf432155ad324fbc0fdb7

SHA512
b61ea1448ec13e88c66e043c0f99d95a2626e631841bec0b0e2e1dd6cbbcb8f8587d414f3ad32794ccdadf7c763910ed844220684f3edc71109f47fe4353c944

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

Filesize
5.7MB

MD5
4e8e47a0f51eff117cda2d2178a6e704

SHA1
d9ad093bdc5b500bfa563f624a51bbca8511ec04

SHA256
01a2a22dc3cf58f4a033abdd15c3a7953584d9da5723af3c34782130c568f71a

SHA512
0551731634e3fa5178ae69c3279014bfc5468adbef0d9a4c4324a957ca6457a7274448566a51ee0edecd581643956915df0456e060bf312b56dbbfac8bf002cf

Download Submit
memory/2180-7-0x0000000003D10000-0x0000000003EC8000-memory.dmp

Filesize
1.7MB

Download
memory/2180-1-0x0000000003D10000-0x0000000003EC8000-memory.dmp

Filesize
1.7MB

Download
memory/2180-0-0x0000000003D10000-0x0000000003EC8000-memory.dmp

Filesize
1.7MB

Download
memory/2180-4-0x0000000003ED0000-0x0000000004087000-memory.dmp

Filesize
1.7MB

Download
memory/2360-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-86-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-10-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-11-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-12-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-29-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-31-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-37-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-51-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-63-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-65-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2360-71-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-69-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-64-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-94-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-99-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-82-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-105-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-108-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-109-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2360-110-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download