Resubmissions
07-05-2024 12:36
240507-pta39afh8x 1007-05-2024 12:36
240507-ps89nafh8t 1007-05-2024 12:36
240507-ps7qtsae72 1007-05-2024 12:36
240507-ps65asfh7y 1007-05-2024 12:36
240507-ps4deafh7w 825-04-2024 13:15
240425-qg8z7abb48 7Analysis
-
max time kernel
118s -
max time network
301s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-04-2024 13:15
Static task
static1
Behavioral task
behavioral1
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win7-20231129-en
Behavioral task
behavioral3
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Resource
win11-20240412-en
General
-
Target
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
-
Size
1.8MB
-
MD5
74f0926d93b595bb0a97d12fcced1f0e
-
SHA1
057b3c704de258d5b858afc884495405af2c7426
-
SHA256
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b
-
SHA512
08f4b6a7ce8104180e538c2999115bc6cba33f3a66564db1b8369100bdbb540296207233cd25441c97f5ada1f4711c7ad4f12b18cc843ce0e9f719852444622a
-
SSDEEP
49152:VFqIJny8yP43p0p3PvdvN71jdII5rYjsAIGi:VFqmnbc45YVN71y1AGi
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral5/memory/3980-3-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-5-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-6-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-7-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-8-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-9-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-14-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-15-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-16-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-25-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-27-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-36-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-45-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-53-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-54-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-55-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-56-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-57-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-61-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-62-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-60-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-59-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-63-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-67-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-72-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-87-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-84-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-106-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-105-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-103-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-101-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-92-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-98-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-97-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-96-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-95-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-93-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-100-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-90-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-78-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-91-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-81-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-85-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-79-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-77-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-83-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-82-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-73-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-76-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-70-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-69-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-66-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-71-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-65-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral5/memory/3980-64-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exedescription pid process target process PID 3856 set thread context of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exepid process 3980 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 3980 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 3980 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 3980 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 3980 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe 3980 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exedescription pid process target process PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe PID 3856 wrote to memory of 3980 3856 f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"C:\Users\Admin\AppData\Local\Temp\f1e87674c6c572fbe566e2570de0cb8a958491b36eda957886f42ceca1fe577b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensusFilesize
2.5MB
MD52980d648c78c4022d9424561f0995f00
SHA188b745a69b46a1a67cf43e759fbfe510af85dec5
SHA256a69c5e427c091b1b429339c58b4ddb78c917cc719dc0401dd45361d716d1e29b
SHA5121eec6a28547d1adf4564646dca7a19d8b6a503c0506f015b53a640a6edf17b12290ee128b60072cf0d86cd20c16798e724746a1771432b20255b9e3ad05c2e6b
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
11.8MB
MD5ae5c8d4fbcf1ddf307ffdcd83d5351f9
SHA1bb95116a4dbd58bfdd347f47b76d34d42eb48df5
SHA256ebddc83b61b3f3491cac510fa5f0199f944575314405be71847ee6457722e25d
SHA51204e69331eb0b7cd9a3e157c3857e60c9e215b3ba7459a5042eb5e7703d41ec826db9610bb2a3e3c857a70e1338796b94ab6f0587f394186f425cd9a02e7f9c10
-
memory/3856-2-0x0000000005030000-0x00000000051E7000-memory.dmpFilesize
1.7MB
-
memory/3856-1-0x0000000004E60000-0x0000000005028000-memory.dmpFilesize
1.8MB
-
memory/3980-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-71-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-9-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-14-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-15-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-16-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-25-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-27-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-36-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-45-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-53-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-54-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-55-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-56-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-61-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-62-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-60-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-59-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-84-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-67-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-3-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-7-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-100-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-103-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-101-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-97-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-95-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-93-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-105-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-91-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-85-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-77-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-73-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-70-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-66-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-106-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-65-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/3980-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB