9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40

Resubmissions

26-04-2024 07:51

240426-jp4xwacb3v 10

26-04-2024 07:51

26-04-2024 07:51

26-04-2024 07:51

26-04-2024 07:51

25-04-2024 12:59

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
26-04-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
Size

1.9MB
MD5

1457ef90efde49a7ee83080ce051d6f7
SHA1

8ca6d983fe2997fa7009458383b84e0d1edeb279
SHA256

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40
SHA512

582628e02510812e0ed06cc05a1bfb98e96f019935efb71d23dd94745a0c5db12771bf0c81579dd7ad4f44b90e7192b95d5d2ed4a6649adc00b486c28df643d0
SSDEEP

49152:Vbe6aahW7iaBUHvG+vxz90ChL0WF+UIGDDS/NL:vaaA7iYb+dtQWFZvSR

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral5/memory/4100-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-26-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-27-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-29-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-36-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-42-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-43-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-44-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-45-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-46-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-47-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-49-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral5/memory/4100-57-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	pid	process	target process
PID 904 set thread context of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

pid	process
4100	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
4100	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
4100	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
4100	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
4100	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
4100	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	pid	process	target process
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 904 wrote to memory of 4100	904	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
"C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
"C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4100

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus
Filesize
2.5MB

MD5
a71659bcabc3b32eed883c95c44b1a62

SHA1
eb0af3adaf524b61490f01e5ae86cfee0bd18663

SHA256
be1ab31af3ff4cec23c0d093e66964ad6e18028e80aa98de834aa6fbe8b598e1

SHA512
0cb24ac55861b5d97658f110525b62803ef9190e7274fb908ff8de9f05e1369d8d8a535d8f8c01e33b5498cc4acb18e0cf7be3b76dc3c6fdad78090d9fbba1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
6.7MB

MD5
6e1d5a01ec33c49b05df72d71271e751

SHA1
45466a4b780cb1de02dbe153db029d7e5611386c

SHA256
ecaca318219e4c6224efd561092162588bba41bf173feafec1bc854f68b23ae9

SHA512
45276feec2c015067e5351fd320fcc1ceab0439f11e3cf50cf489832664fa6b9d3b1d226d3c04be9945718ab77f9f9f069e85ee7f2df67dfadf769a671ce65af

Download Submit
memory/904-1-0x0000000002700000-0x00000000028C1000-memory.dmp

Filesize
1.8MB

Download
memory/904-2-0x00000000028D0000-0x0000000002A87000-memory.dmp

Filesize
1.7MB

Download
memory/4100-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-29-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-26-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-27-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-36-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-42-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-43-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-44-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-45-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-46-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-47-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-49-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/4100-57-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download