9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Size 1.7MB
Sample241107-lbcbtaslfq
SHA256 9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24
MD5 f4e5756bcf1cdb8f4684ae86b2654edb
SHA1 7a1da9d71002884d345ad7ce617bfcdb81fea33e
SHA512 1f611d4fc0217a0daf1cbc80ff49b9dccfe544fbd46040629a17c1d5581e904ede26ee8190f7ab476b780878156f6f82be2474904624a00f23ce9219775f8cb9
SSDEEP 24576:FiU7nuxInXjKzbHhzqfn53piiHowcYA04cT340dwyIEBsKh:AxzbHhzqlpiiIzC4k34R6s0
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3432	sg.tmp
672	SafeMode.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2460-0-0x0000000140000000-0x00000001401F0000-memory.dmp	upx
behavioral2/memory/3440-9-0x0000000140000000-0x00000001401F0000-memory.dmp	upx
behavioral2/memory/2460-61-0x0000000140000000-0x00000001401F0000-memory.dmp	upx
behavioral2/memory/4408-62-0x0000000140000000-0x00000001401F0000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3984	PING.EXE
3216	PING.EXE
4568	PING.EXE
3240	PING.EXE

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
4568	PING.EXE
3240	PING.EXE
3984	PING.EXE
3216	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
672	SafeMode.exe
672	SafeMode.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
672	SafeMode.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeBackupPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeRestorePrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: 33	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeCreateGlobalPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: 33	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: 33	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeBackupPrivilege	3440	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeRestorePrivilege	3440	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: 33	3440	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	3440	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: 33	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeRestorePrivilege	3432	sg.tmp
Token: 35	3432	sg.tmp
Token: SeSecurityPrivilege	3432	sg.tmp
Token: SeSecurityPrivilege	3432	sg.tmp
Token: 33	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeBackupPrivilege	4408	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeRestorePrivilege	4408	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: 33	4408	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
Token: SeIncBasePriorityPrivilege	4408	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1992	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	83
PID 2460 wrote to memory of 1992	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	83
PID 2460 wrote to memory of 3440	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	86
PID 2460 wrote to memory of 3440	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	86
PID 2460 wrote to memory of 3432	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	88
PID 2460 wrote to memory of 3432	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	88
PID 2460 wrote to memory of 672	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	91
PID 2460 wrote to memory of 672	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	91
PID 2460 wrote to memory of 4408	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	93
PID 2460 wrote to memory of 4408	2460	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	93
PID 4408 wrote to memory of 1528	4408	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	94
PID 4408 wrote to memory of 1528	4408	9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe	94
PID 1528 wrote to memory of 3984	1528	cmd.exe	96
PID 1528 wrote to memory of 3984	1528	cmd.exe	96
PID 1528 wrote to memory of 3216	1528	cmd.exe	97
PID 1528 wrote to memory of 3216	1528	cmd.exe	97
PID 1528 wrote to memory of 4568	1528	cmd.exe	98
PID 1528 wrote to memory of 4568	1528	cmd.exe	98
PID 1528 wrote to memory of 3240	1528	cmd.exe	99
PID 1528 wrote to memory of 3240	1528	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
"C:\Users\Admin\AppData\Local\Temp\9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Local\Temp\9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
  PECMD**pecmd-cmd* PUTF -dd -skipb=1280000 -len=451901 "C:\Users\Admin\AppData\Local\Temp\~2070936031551975303.tmp",,C:\Users\Admin\AppData\Local\Temp\9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3440
- C:\Users\Admin\AppData\Local\Temp\~6168306885286818017~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\~2070936031551975303.tmp" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~2854160785054804851"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Users\Admin\AppData\Local\Temp\~2854160785054804851\SafeMode.exe
  "C:\Users\Admin\AppData\Local\Temp\~2854160785054804851\SafeMode.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:672
- C:\Users\Admin\AppData\Local\Temp\9493a586d7d3a54200ef7d7bb5e3494e58b224baa9b69acdf6e6c4629cc22f24.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~2139941360373044003.cmd"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~2139941360373044003.cmd"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3984
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3216
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4568
  - - C:\Windows\system32\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eabrtyig.tmp

Path C:\Users\Admin\AppData\Local\Temp\eabrtyig.tmp
Size 9KB
SHA256 3a1d4d6e4716dc998eece918de429307bcdad5c3c2639104e1b0e97d25fb7f44
MD5 0e35638d847dbe5f7c175fcdd934d922
SHA1 0ce918fbba0d9259fbff18a0fe710e198f335b91
SHA512 86d4c4acbfd4360d2240341fa72ba036385636c18031023d47b37c79aecc0d9aff3235585affceaff86a1444f160519bdd7d6201c350ed2ad02244eacb55cf4d
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

~2070936031551975303.tmp

Path C:\Users\Admin\AppData\Local\Temp\~2070936031551975303.tmp
Size 441KB
SHA256 4bf197f16319d52a27dd9ad7ea785e4ec3c6dc70a6913d15fb30171766f03d7b
MD5 a0850cb82dfa4026bf0da8f1d4af231c
SHA1 80b36aff6b6924a45760254a9890e576a07a6b3b
SHA512 43c385f4633f888da5d79085f957fbd77eb8be2a72cf5c15bbc69c2b98e3eba883ae41214133bf61d474740abc7c144a60c1cc08b6590a59482d209f8f89a3b8
SSDEEP 12288:cw5IbgdEgK713tRKC3h0Pv/JXdktxrjT3L:cwyIEBsKhf
MD5 SHA1 SHA512 SSDEEP

Submit Download

~2139941360373044003.cmd

Path C:\Users\Admin\AppData\Local\Temp\~2139941360373044003.cmd
Size 373B
SHA256 280b524c1f0922cfd3e742ce64ec249c1ce616ba662fd61f5bcb64413da3fc18
MD5 51b9c2a7fcc2188426de71eb88c1ac55
SHA1 9ad52f30b2f02d84dd950709b464a41941f5b3c0
SHA512 9b8721c1ae32774e03aba6b592522397b7b67adcc46ad6ae59c82186da04e7cc8dd1a7601c78051edb74eb047937b8dde1e13271571ffe7ad98e33885a772d62
MD5 SHA1 SHA512

Submit Download

SafeMode.exe

Path C:\Users\Admin\AppData\Local\Temp\~2854160785054804851\SafeMode.exe
Size 911KB
SHA256 612473da1f3f423fc26f40bc047c8a3afbab699cac89f69f7b107fbd1662db3a
MD5 246be8d41a3e79666f4d2091f09336c7
SHA1 d5e4b22d96551c7a681206e0286b8819ebf51d40
SHA512 f1ae4b46faf710127b7dfd9e27afbc59eb09246b718ef7a76729439289a8051d51a5b38a760882a8351a99804c9a2bbb81c6536540cd956c88e5a44f783bbd6a
SSDEEP 24576:z2DW/xbjX2YIb0Qsu3/PNL8QRHygNkWU6:z2EvXVQsW/PNQQ5ZOWU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SafeMode.ini

Path C:\Users\Admin\AppData\Local\Temp\~2854160785054804851\SafeMode.ini
Size 68KB
SHA256 d65cf343693928b5a266f93bef107aa458b7c4e8c675d87937b8b3897564fcf8
MD5 a48edfda5ca1b160f68d59d40d996cd6
SHA1 3b7c1caec4946c10c033bff1ccc14fe8f733b6ef
SHA512 3ed68c2ef08e2bbc8f5c757eb6fd18b3bf8f1bd622bea23699697632adea7a8d2d9101d4072c2a703af2f580cb3d26df8cab89506b11f3e4d532845f780e6732
SSDEEP 1536:NL23lgWL1Fv5zafXqiSqrrplBBZ0sDJXKpwY:NL23+WRXzafXqiSiy
MD5 SHA1 SHA512 SSDEEP

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~6168306885286818017~\sg.tmp
Size 1.1MB
SHA256 b3daf97e499467c6337b4320059ac44bc7a949dc4e500eb0d2f79f900a229531
MD5 8a36dcd25ae8543d26b0a99b7d48864a
SHA1 72581de60cedf59b1b932f6201bafc7cb02bb56e
SHA512 26eecfa81f6c94a89d1f9be0224a3f36309a5c43d658055f48e6e7ee2847c29bddf665f077381ee5b318201bc7658f6cfc36d248f64f51302622e5e949f147ef
SSDEEP 24576:pz9ZONeXrbXmgj/sGKz4QmMkDAjH/Ep4jxH:3ZONUbX/kGKsQmMrb/y4jx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2460-0-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/2460-61-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/3440-9-0x0000000140000000-0x00000001401F0000-memory.dmp

Download

memory/4408-62-0x0000000140000000-0x00000001401F0000-memory.dmp

Download