Analysis

  • max time kernel
    1790s
  • max time network
    1166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-07-2024 08:20

General

  • Target

    UsefulRDPScript.exe

  • Size

    54KB

  • MD5

    e1490e52e145fa12c7b4812b7937b2a7

  • SHA1

    a1fac22bc179d84af24845e49649d2e9a9115b1e

  • SHA256

    b1bce6bd95d8e53bd23030f9157dbf13103df0a9af6371ca73be38d044aad0bd

  • SHA512

    9abefdb032ef833e7ba8bf3e09ded7ba37312aaa9bab88572070156e851cc32df4d4d2eda1f08f60c38deafa996baac76478820286cb31b0283f38f5486d2817

  • SSDEEP

    1536:PEiBwAw/cGYQi1y2QNAx1FcLD12Qs7yGVd7UU2JSS/nouy8:lB9wUGYQN2XD6UdeZvout

Score
7/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UsefulRDPScript.exe
    "C:\Users\Admin\AppData\Local\Temp\UsefulRDPScript.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7733.tmp\7734.tmp\7735.bat C:\Users\Admin\AppData\Local\Temp\UsefulRDPScript.exe"
      2⤵
        PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7733.tmp\7734.tmp\7735.bat

      Filesize

      8KB

      MD5

      78814a514c34812d96730e940f1e6333

      SHA1

      8f13c95b7048f32e708c7f0ae2764dd73fe9ba6b

      SHA256

      adbbdb4da2905a476b84ef57390c51ee26617eba55802998e83ff5d33b92fdc7

      SHA512

      d1dd81c1401c6024c358bfbefa38c4b459961ec354c5bffe25b3f390ca691a1b040b313aefcef537a79a14e3f20e8bfb0164e5ac2d4019bf6c9677ac41603f67

    • memory/3648-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3648-3-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB