Analysis

  • max time kernel
    118s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 00:01

General

  • Target

    45091dcc4a103eb84069e7e8cddb66a0N.exe

  • Size

    83KB

  • MD5

    45091dcc4a103eb84069e7e8cddb66a0

  • SHA1

    171971b49ff6102c41bd066aab434bb91fb8e562

  • SHA256

    f18009dc2b6a94a2e982e72c4fe886f3eb7f2322374e8600ef18bf608cbb6cda

  • SHA512

    90b3d5de07ea5d66e0408fb7dcfa7ecf46f95ee6a2eab230196ff4b4871cec06b12f8c8f86416030b5320f64bb373d369b9d2690f271c85cc0acc5f354f9866f

  • SSDEEP

    1536:q4Gh0o4n0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4n05outQCMUyNjhLJh731xvsr

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 9 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45091dcc4a103eb84069e7e8cddb66a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\45091dcc4a103eb84069e7e8cddb66a0N.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Windows\{CE4519DD-8FB0-4648-9B2B-E9B698B4733F}.exe
      C:\Windows\{CE4519DD-8FB0-4648-9B2B-E9B698B4733F}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\{4E19F029-BD98-4e26-91C2-D6D9AF26DA60}.exe
        C:\Windows\{4E19F029-BD98-4e26-91C2-D6D9AF26DA60}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:376
        • C:\Windows\{5CA8D9AA-1F27-47af-8157-02A3FB8D1C48}.exe
          C:\Windows\{5CA8D9AA-1F27-47af-8157-02A3FB8D1C48}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Windows\{917F42F0-1E12-4b5b-9AB7-F89976FB870F}.exe
            C:\Windows\{917F42F0-1E12-4b5b-9AB7-F89976FB870F}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4312
            • C:\Windows\{7827D9D5-49C9-4c0a-9720-C3E84FC767AD}.exe
              C:\Windows\{7827D9D5-49C9-4c0a-9720-C3E84FC767AD}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2104
              • C:\Windows\{66A962A0-05BE-462b-AC2B-7EE624FE43A1}.exe
                C:\Windows\{66A962A0-05BE-462b-AC2B-7EE624FE43A1}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4352
                • C:\Windows\{DF927AA6-DD2F-4394-A1E7-407A98F91101}.exe
                  C:\Windows\{DF927AA6-DD2F-4394-A1E7-407A98F91101}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4800
                  • C:\Windows\{5714D8E4-3F06-4b05-B3A1-6BE3D57EFC81}.exe
                    C:\Windows\{5714D8E4-3F06-4b05-B3A1-6BE3D57EFC81}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1804
                    • C:\Windows\{349D0F25-FA7A-4cb7-9722-5F4225AC6E12}.exe
                      C:\Windows\{349D0F25-FA7A-4cb7-9722-5F4225AC6E12}.exe
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1400
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{5714D~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:2196
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{DF927~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:3312
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{66A96~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4992
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{7827D~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3068
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{917F4~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3560
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{5CA8D~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2380
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{4E19F~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4652
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CE451~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3712
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\45091D~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\{349D0F25-FA7A-4cb7-9722-5F4225AC6E12}.exe

    Filesize

    83KB

    MD5

    09d099c324b201da32342294631567b8

    SHA1

    5d40fcbda83f127462b133661070f7bab42eb76f

    SHA256

    c2f34c526c2dc8f80585f30696bdb784d8a61e0919ca08140dd2ae14291e59d1

    SHA512

    854f77b16b0f36ac6708f2e108e24dca8c60bcd1d5357efefdd5123d0a16c7365ecc71a78675eb60b4cc2c65821491d2afdff678ccffaed1e7090f9df1f4ba29

  • C:\Windows\{4E19F029-BD98-4e26-91C2-D6D9AF26DA60}.exe

    Filesize

    83KB

    MD5

    1819b870b54376286b22b9a3100d5a40

    SHA1

    cbdded5218709f3bea80faa73f1d8c9f4aad9c57

    SHA256

    12074211ecc0cce01cbf439c8608da13c77dca1a9df480adcf804b23dac6e0e0

    SHA512

    f17a8a004a74b23de191246f4f05d23fcd0cc3e7b7432aa1e76f8e39c6a191a5bea442baca6dfba8e572585010626ad379b6ab090c33cc047252105c69ed28fc

  • C:\Windows\{5714D8E4-3F06-4b05-B3A1-6BE3D57EFC81}.exe

    Filesize

    83KB

    MD5

    40964ec1c591359848c51871ef0b6a9d

    SHA1

    ff2b74cb85d0b4a2877a8358ef7e7bb0526e289c

    SHA256

    a3460dfa17316c2a9b211d64e28a1ddee674a4e00449d605dbeac05ab64f3199

    SHA512

    addfde7938f562ff12a1b461b96dbadd4845389eddce2e2377416ed6523361a9141cf4175ddaa4f446a348747c050b2fe82c0bd0334d3047dcd1b209994f7e33

  • C:\Windows\{5CA8D9AA-1F27-47af-8157-02A3FB8D1C48}.exe

    Filesize

    83KB

    MD5

    1d63ccd09a17b44c58448c533dc8b6b0

    SHA1

    8b4cf5cab57f0268affae58b88c6b2e2d5dcf463

    SHA256

    a3122e0105bf8e7772ab793bc70ed16d6f943510da2102ab5ebb82660bad1d8f

    SHA512

    ad750ebf0e5508c3dd2741f8b5e29add46c61ca702a729d45bd4631bce7d87f5f3a3aaf445fae1c7f3781eda2a5c29c56f9bcfb76d288848c4c576728975605f

  • C:\Windows\{66A962A0-05BE-462b-AC2B-7EE624FE43A1}.exe

    Filesize

    83KB

    MD5

    b75a937d4780ea0980d1223bc6e6c249

    SHA1

    f7d9bad81bd7ba30462aee17e0a8bf73f5c84630

    SHA256

    26a37118e518737e05dab520527430db9a8a71d7abe45d17f1fbf22be53683af

    SHA512

    e10289bfc88f0d68133c46bf47736f05c7ce5a9c5a0c23aae550136ea23781ed899f15d6e1bb4aebd141ab638d891d3c7a9c9740b99af751342dab52d5ba609f

  • C:\Windows\{7827D9D5-49C9-4c0a-9720-C3E84FC767AD}.exe

    Filesize

    83KB

    MD5

    d3cd05c4ccfa0250602a55491bb87bf7

    SHA1

    940b864e7d3b8ab52a9d7ada4cb523e161911ddd

    SHA256

    a430a830d6f7c5860c59a39f1b6b619d289fd5c9cfa944b275d8bf741ef9afe2

    SHA512

    4bfafd891237dee02357288b356871107d807fdbc747ab28acafd405896401c85e55207472d09746a8e15990af157dfe1fc8c071758ee3902c83f31c5d7e2068

  • C:\Windows\{917F42F0-1E12-4b5b-9AB7-F89976FB870F}.exe

    Filesize

    83KB

    MD5

    ccd0ec893afd9607295eb04116494178

    SHA1

    02acfc7cd16e4e6c25dc287b281684f460c0f597

    SHA256

    f7bdb6c337217fb193bea05c6a30b851fc54415dddc392612c2a884b293ed9f1

    SHA512

    729ff34be828ef57edc0b16a38dcf0d203e71bb047c7f87f11798bc39929362d9ea82f0c86814b888d6d8ef493741bdc5983dbc67fcab3ba0cde10519e39491b

  • C:\Windows\{CE4519DD-8FB0-4648-9B2B-E9B698B4733F}.exe

    Filesize

    83KB

    MD5

    ae9164a9b42b54185e639aed7940f0bf

    SHA1

    052857fb489304199d9e5facc0cdd17eb0de34a3

    SHA256

    f9f1377a96d07cc5bfe1b8405ff5132c8c3dca6a748f5e0a5da0b9ab275ec8a8

    SHA512

    40b5516b42e47963cb37dbd4d76f626d346ec524596062c631ba735c17d069420fd1f9846ec52490e23e1ad537c921a54b3ad5d9321a47a513a5d353a3e1fbdf

  • C:\Windows\{DF927AA6-DD2F-4394-A1E7-407A98F91101}.exe

    Filesize

    83KB

    MD5

    f037f8ee192be95e20dfed65257db802

    SHA1

    a250e6a23da447a74873217f635af6d3764f2f76

    SHA256

    d88648a1b0cdafe0e0d0e26d79312a94d5c54d50012f37dc7137b4be6ad86783

    SHA512

    e0bcaa1dbb6c7e0ef0129214401e800eea5fa84228ef4ced6e473e1c91a233e1bb8b553395ed1468bfa95cba4ab20c26a574775d825f1afd368b306b9200e586

  • memory/376-16-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/376-19-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/376-14-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1400-63-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1804-62-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1804-58-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1804-56-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2104-36-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2104-41-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2104-37-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2264-27-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2264-21-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2264-23-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4008-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4008-1-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4008-8-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4312-34-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4312-30-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4312-29-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4352-48-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4352-44-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4352-42-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4776-5-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4776-12-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4776-9-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4800-51-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4800-50-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4800-55-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB