fdad62adfc5a345f6099ca2d8cce20b31bc8d8a72a8cfc78dd3c7bc521185384

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123.exe
Size

158KB
MD5

9ebd849e1d898b5fff5b4309579b58f1
SHA1

5c1ca6e43be704012a1f47ceaab118b00a406a9a
SHA256

fdad62adfc5a345f6099ca2d8cce20b31bc8d8a72a8cfc78dd3c7bc521185384
SHA512

573cf0538ad3e40e0f3002df97a29a309119af92bfceb4b3c059a6521460b7dd24f33b4ea6348898819662027a535689d085f9ace919b54a698a6edc0366b1d7
SSDEEP

3072:mQ4C9g0q4hQ9WCxJDYUfYdWdgDooHeH6neUSua98KDEhlAQ1eXuout:R4y24hXWD24eoo+UeOWS7FoS

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

b2e.exe

pid process

592 b2e.exe
Loads dropped DLL 5 IoCs

Processes:

123.exeWerFault.exe

pid process

2148 123.exe
2148 123.exe
988 WerFault.exe
988 WerFault.exe
988 WerFault.exe

pid	process
592	b2e.exe

pid	process
2148	123.exe
2148	123.exe
988	WerFault.exe
988	WerFault.exe
988	WerFault.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2148-1-0x0000000000400000-0x0000000000784000-memory.dmp	upx
behavioral1/memory/2148-13-0x0000000000400000-0x0000000000784000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

988 592 WerFault.exe b2e.exe

pid	pid_target	process	target process
988	592	WerFault.exe	b2e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

123.exeb2e.exe

description	pid	process	target process
PID 2148 wrote to memory of 592	2148	123.exe	b2e.exe
PID 2148 wrote to memory of 592	2148	123.exe	b2e.exe
PID 2148 wrote to memory of 592	2148	123.exe	b2e.exe
PID 2148 wrote to memory of 592	2148	123.exe	b2e.exe
PID 592 wrote to memory of 988	592	b2e.exe	WerFault.exe
PID 592 wrote to memory of 988	592	b2e.exe	WerFault.exe
PID 592 wrote to memory of 988	592	b2e.exe	WerFault.exe
PID 592 wrote to memory of 988	592	b2e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\123.exe
"C:\Users\Admin\AppData\Local\Temp\123.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148

C:\Users\Admin\AppData\Local\Temp\C9D4.tmp\b2e.exe
"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\C9D4.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\123.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 592 -s 124
3⤵
- Loads dropped DLL
- Program crash
PID:988

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\C9D4.tmp\b2e.exe
Filesize
3.5MB

MD5
7fc4b1d1ac7ef90a8f1a5351e173b43b

SHA1
449db14c63681db7529734af1b70cc557b0e3855

SHA256
807b50dc4644f46eb8e7d8caf9c2bcb2573d0f2aa898825c9748b8253273dbc5

SHA512
dbcd1304367a1b77cf9b1d7a66b026ce34ad367cbe4a10c3776e113a00ba9fb0d0673954d0a03796543c90b735f705597d382d79448889d9f249effde44081f6

Download Submit
memory/592-14-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2148-1-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download
memory/2148-11-0x0000000000920000-0x0000000000925000-memory.dmp

Filesize
20KB

Download
memory/2148-10-0x0000000000920000-0x0000000000925000-memory.dmp

Filesize
20KB

Download
memory/2148-13-0x0000000000400000-0x0000000000784000-memory.dmp

Filesize
3.5MB

Download