Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 02:02

General

  • Target

    7c2906c9277e39c2d1be87adbd342e6faba7b0aa593233663d0007cb4119ccc6.exe

  • Size

    1.9MB

  • MD5

    d9c7beeacdac2aae5d8c675556bfaae9

  • SHA1

    b1c2dd3bd27624a8aa310cbb481b9a64fdbaf921

  • SHA256

    7c2906c9277e39c2d1be87adbd342e6faba7b0aa593233663d0007cb4119ccc6

  • SHA512

    498d3d7053cfb612cc91dc44483ab38431eb694a6aed2613b1d9ad9d90db89001e68fa07ead050fa56bbaa957276f9eea9fb985051d059df4553c66cde130e98

  • SSDEEP

    49152:3rLGA8M9iYz45FWeYTZxTUxXpKg+fmjcozmKxS:65FWBTZxYxJo

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c2906c9277e39c2d1be87adbd342e6faba7b0aa593233663d0007cb4119ccc6.exe
    "C:\Users\Admin\AppData\Local\Temp\7c2906c9277e39c2d1be87adbd342e6faba7b0aa593233663d0007cb4119ccc6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:2192
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:936
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:720
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4828

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\c5d8393293ce2ba62f117b2c2d55bc3e_4fc725d8-4f7d-4884-b878-08bb0ce6c800

          Filesize

          1KB

          MD5

          4a62f34475e1211ea2525fd9e7c1dd8c

          SHA1

          a002c07da41bed0c11ca17e23ef47d1a1b7d6b5f

          SHA256

          bbae846e969480f6b48fb9651fa3a99deb4f29676afcac0ef44c8186baa82eb6

          SHA512

          e28e703b03cccfda378fa8b7f3068f4746e111895a94327b9bce6aa6b0325724ae2255f06a40e725e68d20aad1baa12b519f9c1b3a6c7558cddb4a0fa251b1b1

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\c5d8393293ce2ba62f117b2c2d55bc3e_4fc725d8-4f7d-4884-b878-08bb0ce6c800

          Filesize

          1KB

          MD5

          307465a5aa30f79a7b7cfd06fcce5ea4

          SHA1

          a5c9276eea53a7d91d9fa06cd9842177973ec442

          SHA256

          3c0281eb012823b1aa5198d35708552cc1b2d8658fc5d46ffc5ac7d4adb22fcd

          SHA512

          62768e8098d3220878877e3e6e8766de4b82fecd1fb909bdf25baedda9ef05a3d6626f52dd985117588a5e056a9b1960aadcf8c0575164a577bdb18acb869911

        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2878641211-696417878-3864914810-1000\c5d8393293ce2ba62f117b2c2d55bc3e_4fc725d8-4f7d-4884-b878-08bb0ce6c800

          Filesize

          62B

          MD5

          60806f4f110a6f85831390dafbb98385

          SHA1

          9e27b0bad5f13310a1db8a0c155b3ad7c6b6e446

          SHA256

          219d1a0d4109122414a4ef1b17d392652e94e7492b490ec6ff33ef553d125a4d

          SHA512

          b56bf9de49451eded9debd004a8fd187e6af54a87ef8a1647b6d2f169fc8ef45fd5c6b118f46a4f587bb7f05a170d10cef80211a22d90612a7b6792d7494b6f2

        • memory/2192-218-0x000000007F050000-0x000000007F07B000-memory.dmp

          Filesize

          172KB

        • memory/2408-12-0x0000000002370000-0x0000000002386000-memory.dmp

          Filesize

          88KB

        • memory/2408-15-0x0000000002370000-0x0000000002386000-memory.dmp

          Filesize

          88KB

        • memory/4828-244-0x0000000000400000-0x000000000042B000-memory.dmp

          Filesize

          172KB

        • memory/4828-246-0x0000000004000000-0x000000000408E000-memory.dmp

          Filesize

          568KB

        • memory/4828-245-0x0000000004000000-0x000000000408E000-memory.dmp

          Filesize

          568KB