Resubmissions
02-11-2024 20:23
241102-y59kmatphs 1002-11-2024 20:22
241102-y5sl4svdjp 1002-11-2024 20:21
241102-y49h8stpdz 1002-11-2024 20:17
241102-y2n5hstnfx 10Analysis
-
max time kernel
24s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-11-2024 20:21
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Built.exe
-
Size
6.9MB
-
MD5
f490839c28892955dfc6f341a49bc899
-
SHA1
987358381e0d76686bb2fe23d8ac714586a8ff91
-
SHA256
dff257afb94abb2056a4ef1bda262a04e5ad48844831a95a0ce839590884f5a3
-
SHA512
e0be0e81051646b4ba9161d94c0af72faeb957330abbe9be9ab67bcb29f0cea0663379fdd8a7ac3512493d4839151398ad3f5c82d7a603edb53b1bd62b75c3e7
-
SSDEEP
98304:mVp2DjWM8JEE1F9iamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEV:E207beNTfm/pf+xk4dWRpmrbW3jmr8
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2532 Built.exe -
resource yara_rule behavioral1/files/0x0005000000019506-21.dat upx behavioral1/memory/2532-23-0x000007FEF6510000-0x000007FEF6AF8000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2692 taskmgr.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe -
Suspicious use of SendNotifyMessage 27 IoCs
pid Process 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe 2692 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2532 2672 Built.exe 31 PID 2672 wrote to memory of 2532 2672 Built.exe 31 PID 2672 wrote to memory of 2532 2672 Built.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Loads dropped DLL
PID:2532
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2692
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31