Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 21:53
Behavioral task
behavioral1
Sample
4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe
Resource
win10v2004-20240508-en
General
-
Target
4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe
-
Size
134KB
-
MD5
b3b9455487c8b7e0200fd886bd4da330
-
SHA1
8b8d0118d9b155363e283bf492c7b873b4f79578
-
SHA256
4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a
-
SHA512
1c0a008123801ea3375c02f98417353a19ec831a652b58a5ea14c85245a8ace6b3019f6836899d66743410784b43f246055b98e382d0cef709beffca38222380
-
SSDEEP
1536:YGYU/W2/HG6QMauSV3ixJHABLrmhH7i9eNOOg00GqMIK7aGZh3SO7:YfU/WF6QMauSuiWNi9eNOl0007NZIO7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral1/memory/2320-1-0x0000000000DA0000-0x0000000000DC8000-memory.dmp UPX behavioral1/memory/2320-5-0x0000000000B90000-0x0000000000BB8000-memory.dmp UPX behavioral1/files/0x0036000000015cfd-6.dat UPX behavioral1/memory/1968-7-0x0000000000B90000-0x0000000000BB8000-memory.dmp UPX behavioral1/memory/2320-8-0x0000000000DA0000-0x0000000000DC8000-memory.dmp UPX behavioral1/memory/1968-10-0x0000000000B90000-0x0000000000BB8000-memory.dmp UPX behavioral1/memory/2320-11-0x0000000000DA0000-0x0000000000DC8000-memory.dmp UPX -
Deletes itself 1 IoCs
pid Process 2944 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1968 wuauclt.exe -
Loads dropped DLL 1 IoCs
pid Process 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe -
resource yara_rule behavioral1/memory/2320-1-0x0000000000DA0000-0x0000000000DC8000-memory.dmp upx behavioral1/memory/2320-5-0x0000000000B90000-0x0000000000BB8000-memory.dmp upx behavioral1/files/0x0036000000015cfd-6.dat upx behavioral1/memory/1968-7-0x0000000000B90000-0x0000000000BB8000-memory.dmp upx behavioral1/memory/2320-8-0x0000000000DA0000-0x0000000000DC8000-memory.dmp upx behavioral1/memory/1968-10-0x0000000000B90000-0x0000000000BB8000-memory.dmp upx behavioral1/memory/2320-11-0x0000000000DA0000-0x0000000000DC8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\wuauclt.exe\" /run" 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1968 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 28 PID 2320 wrote to memory of 1968 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 28 PID 2320 wrote to memory of 1968 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 28 PID 2320 wrote to memory of 1968 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 28 PID 2320 wrote to memory of 2944 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 29 PID 2320 wrote to memory of 2944 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 29 PID 2320 wrote to memory of 2944 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 29 PID 2320 wrote to memory of 2944 2320 4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe"C:\Users\Admin\AppData\Local\Temp\4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\ProgramData\Update\wuauclt.exe"C:\ProgramData\Update\wuauclt.exe" /run2⤵
- Executes dropped EXE
PID:1968
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\4d1e5f808b9e90b9b7ac9e32b4e11b2ef223745fa707aa4c34f60e3bd72ae42a.exe" >> NUL2⤵
- Deletes itself
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD56dcec8f3d1d6cc8d3ebe3b6dad25d904
SHA1e091f4cca193ba9bb7859c9ab2f51bee9e35918c
SHA2566da5e096cb83825c8b893d8d5f71711e48e77c1d0c51be69294150c21b9e011d
SHA5121f24f5b9db47b9943a6d85a835ec6e17dda58c852ef278dc74a3aa22e8129e0585cfa2ba43fd532fa7fcb82c3b76157cc3f94afd845c5939fbd07be551398c02