Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:43
Static task
static1
Behavioral task
behavioral1
Sample
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
Resource
win10v2004-20240426-en
General
-
Target
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
-
Size
1.9MB
-
MD5
8305c45696b7e6763ff343ca024682d1
-
SHA1
b645f3fe56ac86ffde7d0e72ef48cd3eb4f48220
-
SHA256
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e
-
SHA512
0140f7b9f17ef4491e901eae2b6d882975e679594e1d208fc13e19bc88670b274f7b36f79f94a0f03baf1413c87aeb5cf42687d41ae4b85f9c98b7c38f54474a
-
SSDEEP
49152:WlsJPNJLt1TzK2m8Q2AajccD1RTsTmeC2yHL+Hq:WOJPNJDm8Q2Q4Tf2Y6
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4580-2-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-4-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-5-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-7-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-6-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-8-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-9-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-22-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-32-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-39-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-43-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-44-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-50-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-51-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-52-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-56-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-57-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-58-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-62-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-63-0x0000000000400000-0x0000000000848000-memory.dmp upx behavioral2/memory/4580-64-0x0000000000400000-0x0000000000848000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\"" 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exedescription pid process target process PID 1648 set thread context of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exepid process 4580 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 4580 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 4580 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 4580 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 4580 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 4580 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exedescription pid process target process PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe PID 1648 wrote to memory of 4580 1648 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe 649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"C:\Users\Admin\AppData\Local\Temp\649a88ef17dafb0bd1f0d55e752de143e2428927dd5e754b65b5b4b251069c1e.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD571ac77addcdf12cc01f58c395988a6f0
SHA151036487a286025fd91b0bdc5f91d6ef357319e8
SHA2560c2c827ae153454e8250c93f3a4352160d437ffeab13adf533a1d448cd9811ce
SHA51213ba6073c248a369e28c28ab1f813e502fc5d14aabf81169ff37673dbf9c2537f477f525109f63ffa7b3dd7cc00c9ab22527082b7cc2cdd08b26c2d2e3a97529
-
Filesize
10.3MB
MD5e4f1b1b220eba773e384380d8d83d701
SHA1994ccb392ab2cef542fde6cb96754e4de985e454
SHA2569ecb242347d568bbc97dc20021229f6f2524810aa69e5169d40afde9549ee522
SHA5125f1515017908677df48436e148f8fa12ec885ad576a1194fd2c7b7fda1ceccb8c93367702118483dc8f59669e431a86e923078de4f1f1434ea139c6a3f5f7ad7