9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40

Resubmissions

26-04-2024 07:51

240426-jp4xwacb3v 10

26-04-2024 07:51

26-04-2024 07:51

26-04-2024 07:51

26-04-2024 07:51

25-04-2024 12:59

Analysis

max time kernel
147s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
26-04-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
Size

1.9MB
MD5

1457ef90efde49a7ee83080ce051d6f7
SHA1

8ca6d983fe2997fa7009458383b84e0d1edeb279
SHA256

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40
SHA512

582628e02510812e0ed06cc05a1bfb98e96f019935efb71d23dd94745a0c5db12771bf0c81579dd7ad4f44b90e7192b95d5d2ed4a6649adc00b486c28df643d0
SSDEEP

49152:Vbe6aahW7iaBUHvG+vxz90ChL0WF+UIGDDS/NL:vaaA7iYb+dtQWFZvSR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/556-2-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-4-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-13-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-22-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-23-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-24-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-29-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-34-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-48-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-52-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-53-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-54-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-58-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral1/memory/556-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	pid	process	target process
PID 836 set thread context of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

pid	process
556	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
556	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
556	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
556	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
556	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
556	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	pid	process	target process
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 836 wrote to memory of 556	836	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
"C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
"C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:556

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus
Filesize
2.5MB

MD5
a71659bcabc3b32eed883c95c44b1a62

SHA1
eb0af3adaf524b61490f01e5ae86cfee0bd18663

SHA256
be1ab31af3ff4cec23c0d093e66964ad6e18028e80aa98de834aa6fbe8b598e1

SHA512
0cb24ac55861b5d97658f110525b62803ef9190e7274fb908ff8de9f05e1369d8d8a535d8f8c01e33b5498cc4acb18e0cf7be3b76dc3c6fdad78090d9fbba1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
5.4MB

MD5
fd55e1500ab6b287c9bbd30cd04db281

SHA1
bf32ae065c23bbe9626815c6226c851540f7e3bc

SHA256
c4acf073289b03c954b9bf897d02e2714a092b666b9800b1f82eb950127adbe1

SHA512
0286549da73307dee31a8b4f044c4096b9a6aa7edc85ca63afbf00b73e1dd99f86f68febfc13311606d3b4b47858832c57d691066baeb0ba6fdb84a00ac705c0

Download Submit
memory/556-24-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-13-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-2-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-22-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-23-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-4-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-34-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-48-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-52-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-53-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-54-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-58-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/556-29-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/836-3-0x0000000002860000-0x0000000002A17000-memory.dmp

Filesize
1.7MB

Download
memory/836-1-0x0000000002670000-0x0000000002831000-memory.dmp

Filesize
1.8MB

Download