737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6

Analysis

max time kernel
149s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe
Size 341KB
Sample240602-3lblpsbc5v
SHA256 737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6
MD5 3cec80fa9a6234b9e996de3dfb721192
SHA1 c1f29c1c812df572fcd76e86aa4417dc7769782a
SHA512 cb6cbddc6ecf388fb1398a64cd35ade16e05b86b0073630cbea2c670e8adfb90868366585b42cfa92c4e3bed3fe162c959f91233aaaac4a602e868493d8dd6cb
SSDEEP 3072:hINzztfivMVMYuFkV3qBnFqOLp4mvy2ACh3gj5z8UPCMgqKR+n:hIVz8YurEmvy2AChOzLCWKR
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3792-0-0x0000000000400000-0x000000000042EC51-memory.dmp	UPX
behavioral2/memory/3792-8-0x0000000000400000-0x000000000042EC51-memory.dmp	UPX
behavioral2/files/0x00070000000233b8-9.dat	UPX
behavioral2/memory/216-11-0x0000000000400000-0x000000000042EC51-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
216	wuauclt.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3792-0-0x0000000000400000-0x000000000042EC51-memory.dmp	upx
behavioral2/memory/3792-8-0x0000000000400000-0x000000000042EC51-memory.dmp	upx
behavioral2/files/0x00070000000233b8-9.dat	upx
behavioral2/memory/216-11-0x0000000000400000-0x000000000042EC51-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ieuu = "\"C:\\PROGRA~2\\ICROSO~1.NET\\wuauclt.exe\" -vt yazb"	wuauclt.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe
File created	C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe
File opened for modification	C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe:bla	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe
File opened for modification	C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe	wuauclt.exe
File created	C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe	wuauclt.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe:bla	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 216	3792	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe	83
PID 3792 wrote to memory of 216	3792	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe	83
PID 3792 wrote to memory of 216	3792	737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe	83

C:\Users\Admin\AppData\Local\Temp\737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe
"C:\Users\Admin\AppData\Local\Temp\737ebb167aa1d2488338c9e7054d061fab21211a0443fd052b8247388a719ca6.exe"
1⤵
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3792
- C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe
  C:\PROGRA~2\ICROSO~1.NET\wuauclt.exe --ru -vt yazb
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wuauclt.exe

Path C:\Program Files (x86)\Мicrosoft.NET\wuauclt.exe
Size 341KB
SHA256 d1175340ae658524bfca2f842969af6ef75908ca7d168080713538e0033fde02
MD5 d57e6c619476c5c6914dfcc907f5cacf
SHA1 9e81c29d3b07e339c921170325801b8a0517cfa2
SHA512 51c22a23cd6efb33c520a2155d657f39a53c9e3f9c3bf6b908e4d24be5ae9a9341bcd4dae6472ac7da6ec6e412dd51f9d2af28039437cc5e6a7c3132ebfa3bee
SSDEEP 3072:hINzztfivMVMYuFkV3qBnFqOLp4mvy2ACh3gj5z8UPCMgqKR+n:hIVz8YurEmvy2AChOzLCWKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-11-0x0000000000400000-0x000000000042EC51-memory.dmp

Download

memory/3792-0-0x0000000000400000-0x000000000042EC51-memory.dmp

Download

memory/3792-8-0x0000000000400000-0x000000000042EC51-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads