7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab

Analysis

max time kernel
148s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe
Size

408KB
MD5

b31529cb377581e6e40073028e7ce4f0
SHA1

d4319d86dd4ed3e971a4c8db24bbb1febe8a5ac7
SHA256

7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab
SHA512

6498721907f0ada65b0a9cdab8707bde672df3c61e351d15748e9f6ef49f0f101ce4661fd0b190d0fc85961fc91afe9d433ad21a5939061a96ea068ec8770771
SSDEEP

6144:4jlYKRF/LReWAsUyV06X0cTeb26trtjcwJLue2TAk:4jauDReWVTp6VtFuegV

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

fxhusn.exe

pid process

2008 fxhusn.exe

pid	process
2008	fxhusn.exe

Loads dropped DLL 2 IoCs

Processes:

7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe

pid	process
2040	7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe
2040	7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

fxhusn.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\fxhusn.exe"	fxhusn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe

description	pid	process	target process
PID 2040 wrote to memory of 2008	2040	7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe	fxhusn.exe
PID 2040 wrote to memory of 2008	2040	7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe	fxhusn.exe
PID 2040 wrote to memory of 2008	2040	7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe	fxhusn.exe
PID 2040 wrote to memory of 2008	2040	7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe	fxhusn.exe

C:\Users\Admin\AppData\Local\Temp\7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe
"C:\Users\Admin\AppData\Local\Temp\7562f4773262ce50ac9d779028493d9308641878a263b936b4364d0816228dab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\ProgramData\fxhusn.exe
"C:\ProgramData\fxhusn.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2008

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache .exe
Filesize
408KB

MD5
47c7cddf332fe24fd99cb2c5b124a117

SHA1
1e4e0b7b0f43ea80fcfdb4c28ab08fac41ad7277

SHA256
355e15fd956391d28c01a1dd544f9e0cf22f2b60692fe83f483045cd54254d6d

SHA512
058da512daf85a71bdaa9d01f981193cbebfb28e8152e1a1a493b04bb1aabf81bb6bda3e0ed10ad2221a5b4775617203b53c1d8d6862e619e64fa555a729372a

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\fxhusn.exe
Filesize
271KB

MD5
14e817c8b663868286a9e3843586d8d0

SHA1
8e3518c4b0f26b127262663c6c08e03603a17b2c

SHA256
fbdecf230d246108cb6bd904d174fcbeea0a46dcee85633fab06390b732cfa19

SHA512
39e6142a870a56ad847c40063695a815d27a421a832ddf672bf7b5a211bef218c0d621e95948dfb2e04e239106f88980b26d4ed5f9348c11c12d2171ea2937fc

Download Submit
memory/2008-135-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2040-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2040-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2040-11-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads