66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe
Size

134KB
MD5

2aeb47451c625e41958f070e5ce07981
SHA1

aae4402506ec23f78af5204e95cadcbf2c264cc4
SHA256

66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f
SHA512

130533e284b9c490ccf61cbaa766f62629de13364bc89d84c66217ee26765797461cb3276983ed9a92a6e4472d5cd1cfb1791515198294250bf859389bded210
SSDEEP

1536:rF0AJELopHG9aa+9qX3apJzAKWYr0v7ioy6paK2AZqMIK7aGZh38Qz:riAyLN9aa+9U2rW1ip6pr2At7NZuQz

Score

9^/10

persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000ED0000-0x0000000000EF8000-memory.dmp	UPX
behavioral1/files/0x0037000000016d3d-2.dat	UPX
behavioral1/memory/2536-7-0x0000000000F20000-0x0000000000F48000-memory.dmp	UPX
behavioral1/memory/2980-8-0x0000000000ED0000-0x0000000000EF8000-memory.dmp	UPX
behavioral1/memory/2536-10-0x0000000000F20000-0x0000000000F48000-memory.dmp	UPX
behavioral1/memory/2980-11-0x0000000000ED0000-0x0000000000EF8000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2536	WwanSvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2980	66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000ED0000-0x0000000000EF8000-memory.dmp	upx
behavioral1/files/0x0037000000016d3d-2.dat	upx
behavioral1/memory/2980-5-0x0000000000130000-0x0000000000158000-memory.dmp	upx
behavioral1/memory/2536-7-0x0000000000F20000-0x0000000000F48000-memory.dmp	upx
behavioral1/memory/2980-8-0x0000000000ED0000-0x0000000000EF8000-memory.dmp	upx
behavioral1/memory/2536-10-0x0000000000F20000-0x0000000000F48000-memory.dmp	upx
behavioral1/memory/2980-11-0x0000000000ED0000-0x0000000000EF8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Window Update = "\"C:\\ProgramData\\Update\\WwanSvc.exe\" /run"	66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2536	2980	66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe	28
PID 2980 wrote to memory of 2536	2980	66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe	28
PID 2980 wrote to memory of 2536	2980	66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe	28
PID 2980 wrote to memory of 2536	2980	66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe	28

C:\Users\Admin\AppData\Local\Temp\66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe
"C:\Users\Admin\AppData\Local\Temp\66bde7f9732db408e8398764915337a7ed37c73b47b07fd350ec720df0a1587f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2980
- C:\ProgramData\Update\WwanSvc.exe
  "C:\ProgramData\Update\WwanSvc.exe" /run
  2⤵
  - Executes dropped EXE
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\Update\WwanSvc.exe

Filesize
134KB

MD5
9f2a99231dec4aaa56b1269da1e3ecfd

SHA1
c012b2789f05604c1573d97d4f16062513d38c4c

SHA256
08bf31f3a742c20a5dd24578df6f0da4678eee502e3c9996bc5bceda095e26c6

SHA512
97c4ae5dba1f94499ae65c55832979524086369f7a8d435d6763f5dba2bdaed5b3f13594efcc9d11760677dee0d23ef187ab01da8eda36fa1653c77f371d89d6

Download Submit
memory/2536-7-0x0000000000F20000-0x0000000000F48000-memory.dmp

Filesize
160KB

Download
memory/2536-10-0x0000000000F20000-0x0000000000F48000-memory.dmp

Filesize
160KB

Download
memory/2980-0-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Filesize
160KB

Download
memory/2980-5-0x0000000000130000-0x0000000000158000-memory.dmp

Filesize
160KB

Download
memory/2980-8-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Filesize
160KB

Download
memory/2980-9-0x0000000000130000-0x0000000000158000-memory.dmp

Filesize
160KB

Download
memory/2980-11-0x0000000000ED0000-0x0000000000EF8000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads