48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe
Size

30KB
MD5

07fd96a6c350ef7504eb87ebfebba57c
SHA1

3c596b393f0188020029466a01c8ed84b8283ca3
SHA256

48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990
SHA512

fe9f7d9bbc63874521fcfbe36cc1ea4297f6c58ad6ce546efd3b8faee8dd3cabb6eda9a7c0c32fc9f3eca64c3356f9c4c743ebab2fe65f2b0d528878ebad17be
SSDEEP

768:7JpMcU2hW/IzV/K7m/41b0HnuaN7Dq5zpywA0:bMcU28wzV/KKg1b8u9zpw0

Score

9^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral1/memory/1424-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/files/0x000a000000012286-8.dat	INDICATOR_EXE_Packed_MPress
behavioral1/memory/1424-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2140-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral1/memory/2140-15-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_MPress

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/1424-0-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral1/memory/1424-10-0x0000000000400000-0x0000000000414000-memory.dmp	UPX
behavioral1/memory/2140-15-0x0000000000400000-0x0000000000414000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2140	legan.exe

Loads dropped DLL 1 IoCs

pid	Process
1424	48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2140	1424	48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe	28
PID 1424 wrote to memory of 2140	1424	48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe	28
PID 1424 wrote to memory of 2140	1424	48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe	28
PID 1424 wrote to memory of 2140	1424	48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe	28

C:\Users\Admin\AppData\Local\Temp\48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe
"C:\Users\Admin\AppData\Local\Temp\48019ff6610b68f0f54f57f15cfa4b4ef896f8e611c6a20066f13bf4c22b1990.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\legan.exe
  "C:\Users\Admin\AppData\Local\Temp\legan.exe"
  2⤵
  - Executes dropped EXE
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\legan.exe

Filesize
30KB

MD5
b133458d4b7abc8665c88618a7f54b97

SHA1
97de353e6ca62cc7f60eaa4d300f88a87ce8574f

SHA256
e623e6d466cadaa251e1cdc1a8945bc8a7668d0182f0f50d77b81a15cb017d5f

SHA512
f4fa6aad01b3ceb799204c0eb2221a332af85731a58bb21107097007f8746359041b086fdee1a9377cd915cd5677c24008411d2425e0278e0972b8efee1483fd

Download Submit
memory/1424-1-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/1424-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1424-2-0x0000000004000000-0x0000000004006000-memory.dmp

Filesize
24KB

Download
memory/1424-10-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2140-11-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2140-15-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download