83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733.exe
Size

150KB
MD5

5897437892e0eaf2269f552bfbaf58bf
SHA1

f8d850dec72bef120a38831308c2b46b4107e8f1
SHA256

83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733
SHA512

7862d38977ed61ee9575c4f0ff7025754a4074b799c540f6a3d07de986ac0f2d4c40662bb4ae0c227eb72b9502482e5704a86a747dcf22d991b2a31f58aa4d33
SSDEEP

3072:ge6FFhMinon+m7Of18tZ9PHnF+orVd/WDbf2k+nOkxCu6f:lWpcrPHnf0+vxCbf

Score

9^/10

persistence

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 3 IoCs

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x000000000045D000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000c00000001445e-5.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1072-7-0x0000000000400000-0x000000000045D000-memory.dmp	INDICATOR_EXE_Packed_MPress

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
1072	tbckyxk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tbckyxk.exe	83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733.exe
File created	C:\PROGRA~3\Mozilla\newtrln.dll	tbckyxk.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2248	83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733.exe
1072	tbckyxk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1072	2732	taskeng.exe	29
PID 2732 wrote to memory of 1072	2732	taskeng.exe	29
PID 2732 wrote to memory of 1072	2732	taskeng.exe	29
PID 2732 wrote to memory of 1072	2732	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733.exe
"C:\Users\Admin\AppData\Local\Temp\83bf54974e67a8a96e6360cfd0a6a22900fa4fb81da37dc3fb10cc976a6e0733.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2248

C:\Windows\system32\taskeng.exe
taskeng.exe {BC11366A-09FB-4EE9-8AFC-8A7CF8A968E8} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\PROGRA~3\Mozilla\tbckyxk.exe
  C:\PROGRA~3\Mozilla\tbckyxk.exe -gqpcbye
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\tbckyxk.exe

Filesize
150KB

MD5
6d0a4cc92a5d8516b41751e6be15dc2e

SHA1
49e24615230b54d29b8f3e3c716cf4a78939155b

SHA256
9cb6bb71553e0a11ad38f1ac54ca46b83f0c0959157d80fa8fa2c945b5fb842c

SHA512
2778617d40a19c0134b41d348ce5e090468b3acffa48274e347dee155c1fdf2de88448f8f3bb903ac1bc16e6b264a72efc83b2453184a8c0529713283fb4cf21

Download Submit
memory/1072-7-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1072-8-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/1072-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2248-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2248-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2248-2-0x0000000000260000-0x00000000002BB000-memory.dmp

Filesize
364KB

Download
memory/2248-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download