Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 21:35
Behavioral task
behavioral1
Sample
47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe
Resource
win10v2004-20240426-en
General
-
Target
47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe
-
Size
134KB
-
MD5
23698b87276655fe6c240b4cda58c9a3
-
SHA1
878e7f6eedab962811428dc493de353000c949c6
-
SHA256
47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04
-
SHA512
83a485f643431c7ded551578a9d5924759d62b54a17f128024b3b4a5640082e3a1509d5a6972754829a4d17d78fd6f292505191b06ac83ddbf2f048085ef9aa1
-
SSDEEP
1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Q2:riAyLN9aa+9U2rW1ip6pr2At7NZuQ2
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/memory/3148-0-0x0000000000600000-0x0000000000628000-memory.dmp UPX behavioral2/files/0x0008000000023450-3.dat UPX behavioral2/memory/3156-6-0x0000000000B90000-0x0000000000BB8000-memory.dmp UPX behavioral2/memory/3148-5-0x0000000000600000-0x0000000000628000-memory.dmp UPX behavioral2/memory/3156-7-0x0000000000B90000-0x0000000000BB8000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 3156 WwanSvc.exe -
resource yara_rule behavioral2/memory/3148-0-0x0000000000600000-0x0000000000628000-memory.dmp upx behavioral2/files/0x0008000000023450-3.dat upx behavioral2/memory/3156-6-0x0000000000B90000-0x0000000000BB8000-memory.dmp upx behavioral2/memory/3148-5-0x0000000000600000-0x0000000000628000-memory.dmp upx behavioral2/memory/3156-7-0x0000000000B90000-0x0000000000BB8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run" 47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3148 wrote to memory of 3156 3148 47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe 81 PID 3148 wrote to memory of 3156 3148 47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe 81 PID 3148 wrote to memory of 3156 3148 47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe"C:\Users\Admin\AppData\Local\Temp\47c77c69cd8fbaf270ab41bc96f8da0c2c3c10e22dc02fe78947028df54c6e04.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\ProgramData\Update\WwanSvc.exe"C:\ProgramData\Update\WwanSvc.exe" /run2⤵
- Executes dropped EXE
PID:3156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD533e9ee1ce8743f7894b3d6503f71f62c
SHA1b58a1f7124f1cd00be4bc07e4914e06c4c2cf0c1
SHA256b354a14668108e3842c96e1545a7b99edeef048bc9e73987a90da5e0953b2819
SHA512ea0028d79ba5c14e78b4fe9f8ce83a1f856bd8640a1f9f3324587e843aac710aab945ca8ae5aab8c3b227b911d61538357f1389ba56aa9dc11b16d9aec0df001