38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955a

Analysis

max time kernel
110s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe
Size 106KB
Sample240921-mxevhaydmm
SHA256 38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955a
MD5 e695bcc35d384ea68a6d530daa2de310
SHA1 22f1ca3ec0af526cff683ee7f118543d8eefb09f
SHA512 8ef88695ec967916d7a40379559e82403c68e9db58e6b292936584d38ef9582d6520319cb797845d8f95ea5b4cf0443dcae89194a596db288f9364ac7a9b3edc
SSDEEP 1536:S0Af86qG+OAC4Wv2MigTdU/2c7o8rZFflp2pmr2OPqXZ79wpMxe6IG:+01OACv2MTu/jjfj2p222qp79wpMxg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3224	netprotocol.exe
3760	netprotocol.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2420-0-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/2420-2-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/2420-8-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x0007000000023479-12.dat	upx
behavioral2/memory/3224-13-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/3224-22-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netprotocol = "C:\\Users\\Admin\\AppData\\Roaming\\netprotocol.exe"	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2420 set thread context of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 3224 set thread context of 3760	3224	netprotocol.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netprotocol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 2420 wrote to memory of 3212	2420	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	89
PID 3212 wrote to memory of 3224	3212	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	90
PID 3212 wrote to memory of 3224	3212	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	90
PID 3212 wrote to memory of 3224	3212	38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe	90
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91
PID 3224 wrote to memory of 3760	3224	netprotocol.exe	91

C:\Users\Admin\AppData\Local\Temp\38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe
"C:\Users\Admin\AppData\Local\Temp\38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe
  38552760897449326055c0ae9ba539ef3c1ae3b421eb7cfd0862c5a2f16a955aN.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Users\Admin\AppData\Roaming\netprotocol.exe
    C:\Users\Admin\AppData\Roaming\netprotocol.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Users\Admin\AppData\Roaming\netprotocol.exe
      netprotocol.exe
      4⤵
      Executes dropped EXE
      PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

netprotocol.exe

Path C:\Users\Admin\AppData\Roaming\netprotocol.exe
Size 106KB
SHA256 fea7ea2fe690c5c1aee7ebbb7e615f6af7899e66b38cfdec9acece7ba09f914c
MD5 2abed339bc783e65cfd4df37baba1f71
SHA1 59acd7214fffdbf2b8cad403a49754528444b8a1
SHA512 79dd0a0291b406a0de1c0717d2976d1f42a90d725d65c4d0b484aae609e51b4b091998d1ee2aabaac7b83fe1cead0dedb59117e25274c299163bfa1d34f2ae1d
SSDEEP 1536:+0Af86qG+OAC4Wv2MigTdU/2c7o8rZFflp2pmr2OPqXZ79wpMxe6IG:C01OACv2MTu/jjfj2p222qp79wpMxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2420-8-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2420-2-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2420-0-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3212-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3212-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3212-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3212-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3212-23-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3224-13-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3224-22-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/3760-20-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3760-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads