Analysis

  • max time kernel
    106s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21-08-2024 21:05

General

  • Target

    54df5e1d18f36a2d11eb1687d15a80d0N.exe

  • Size

    88KB

  • MD5

    54df5e1d18f36a2d11eb1687d15a80d0

  • SHA1

    be4c702e9f5b23a02e037bcc6725ea8dae540b71

  • SHA256

    2d4f592791dcc72fa4b58c7106a705e7649387f326b6d69db774361a99fae8c2

  • SHA512

    5e8712dcf2c4324c6d76d4dc0bf3f8ad3c26dec4c16595b4201585766eb17a2789cbc90cb60416aceac101f252676996f1bd55e77238babd3c32a265740d2a87

  • SSDEEP

    1536:t5piVnDXkTbhCtaB6GVA/bVQPxfgiqfoOonoKg+yOH5y/yE3:6D0ctAVA/bmxIMnoKjyR/N3

Score
7/10

Malware Config

Signatures

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54df5e1d18f36a2d11eb1687d15a80d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\54df5e1d18f36a2d11eb1687d15a80d0N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2512
    • C:\Users\Admin\AppData\Local\Temp\54df5e1d18f36a2d11eb1687d15a80d0N.exe
      "C:\Users\Admin\AppData\Local\Temp\54df5e1d18f36a2d11eb1687d15a80d0N.exe"
      2⤵
        PID:193868
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\LYHIT.bat" "
          3⤵
            PID:54576

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\LYHIT.bat

        Filesize

        149B

        MD5

        6831b89d0b8dc3e07588d733e75c122b

        SHA1

        8c70088c3224bbaf535ed19ec0f6bd5231c543be

        SHA256

        9fe102f2c6dff35f03787b85f725d12347cf491c897730a7f2e818f65177ffc2

        SHA512

        699fb44a25032ee4ad0ace1f941c826b333baddb65049c22e80b272909e85f4c8a00fef73fe2d97fa8998a0b6969b13461237bfc1e8f9bf711849d17d0cda6da

      • memory/2512-210111-0x00000000003D0000-0x00000000003D2000-memory.dmp

        Filesize

        8KB

      • memory/2512-2-0x00000000002C0000-0x00000000002C1000-memory.dmp

        Filesize

        4KB

      • memory/2512-58-0x0000000000370000-0x0000000000371000-memory.dmp

        Filesize

        4KB

      • memory/2512-38-0x0000000000320000-0x0000000000321000-memory.dmp

        Filesize

        4KB

      • memory/2512-178-0x00000000003D0000-0x00000000003D2000-memory.dmp

        Filesize

        8KB

      • memory/2512-176-0x00000000003C0000-0x00000000003C2000-memory.dmp

        Filesize

        8KB

      • memory/2512-76-0x00000000003B0000-0x00000000003B2000-memory.dmp

        Filesize

        8KB

      • memory/2512-68-0x0000000000390000-0x0000000000391000-memory.dmp

        Filesize

        4KB

      • memory/2512-26-0x0000000000300000-0x0000000000301000-memory.dmp

        Filesize

        4KB

      • memory/2512-14-0x00000000002E0000-0x00000000002E1000-memory.dmp

        Filesize

        4KB

      • memory/2512-4-0x00000000002C0000-0x00000000002C1000-memory.dmp

        Filesize

        4KB

      • memory/2512-210110-0x00000000003C0000-0x00000000003C2000-memory.dmp

        Filesize

        8KB

      • memory/193868-540760-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/193868-540762-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/193868-540764-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/193868-540765-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/193868-540766-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/193868-540767-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/193868-540758-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB