122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe
Size 80KB
Sample241110-bcat9svpcx
SHA256 122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1
MD5 c98bb45f5b58a274e366c1c56f263ac0
SHA1 fd9aa4cb8f112fc130d29a2759cf2d10f2126dcc
SHA512 4424df4ea662e5ea77609d86d6a8b6af7ed2c1feed9e7c14ad237823806553632d367bfa2061aafe5483891649f642ce91db36753603cf47915116ce51004a1e
SSDEEP 1536:M+gNsi/OTW1bk3FwErVvHcT2P4OFCrJZlHES8Vd+jF:MxZ1bk1FVvHcTmdFCrJRR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2764	bot1.exe

Loads dropped DLL 2 IoCs

pid	Process
2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe
2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2676-53-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2676-35-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2676-34-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2676-33-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2676-27-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2676-24-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2676-22-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system\bot1.exe	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe
File opened for modification	C:\Windows\system\bot1.exe	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe
File opened for modification	C:\Windows\system\RCX34F5.tmp	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2676	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2764	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	30
PID 2028 wrote to memory of 2764	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	30
PID 2028 wrote to memory of 2764	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	30
PID 2028 wrote to memory of 2764	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	30
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2028 wrote to memory of 2676	2028	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	31
PID 2676 wrote to memory of 1252	2676	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	21
PID 2676 wrote to memory of 1252	2676	122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Users\Admin\AppData\Local\Temp\122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe
  "C:\Users\Admin\AppData\Local\Temp\122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system\bot1.exe
    "C:\Windows\system\bot1.exe"
    3⤵
    - Executes dropped EXE
    PID:2764
- - C:\Users\Admin\AppData\Local\Temp\122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe
    "C:\Users\Admin\AppData\Local\Temp\122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe" -cure -offset=81920 -rcline="C:\Users\Admin\AppData\Local\Temp\122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MyRep.dat

Path C:\MyRep.dat
Size 805B
SHA256 c19689224c3becf0527523581eada8e8077c8834bea8ac4a67034253a5c825f2
MD5 1ca80373d987e3ef648b22264ad0aa35
SHA1 9bc4ed887421ff99b9bb1a6c4123f1b2cc34843e
SHA512 9989642c0e54e582a78e2397d1b2ff77e33c149e9275faf72b35047d5b300ff90d397797f22331c2e1928e85cdab24c65a7835bacee21591072142129f800c78
MD5 SHA1 SHA512

Submit Download

bot3506.tmp

Path C:\Users\Admin\AppData\Local\Temp\bot3506.tmp
Size 80KB
SHA256 122e116a17db5bdcd224d7c4d83d6ad05b924269afb91349928c72a5c2461ee1
MD5 c98bb45f5b58a274e366c1c56f263ac0
SHA1 fd9aa4cb8f112fc130d29a2759cf2d10f2126dcc
SHA512 4424df4ea662e5ea77609d86d6a8b6af7ed2c1feed9e7c14ad237823806553632d367bfa2061aafe5483891649f642ce91db36753603cf47915116ce51004a1e
SSDEEP 1536:M+gNsi/OTW1bk3FwErVvHcT2P4OFCrJZlHES8Vd+jF:MxZ1bk1FVvHcTmdFCrJRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

bot1.exe

Path C:\Windows\system\bot1.exe
Size 80KB
SHA256 b3b78202f29b035c1a97aa0a1aeb07a7b76b522f8837baf845dd6a0fd49e8f12
MD5 a98c719dc42769a2af355bdf2188b1b9
SHA1 b4a6ae01ba8a5e1bd24decfe40aeb68956db9743
SHA512 e216d41df5801f5545cd6b1d21e21ffee29aba0b1b15b7d8b269153ddbdd0d30aabcbf19900dd30937318268c32f44718f8a0606950a9820ceb1f943581ff0ca
SSDEEP 1536:0+gNsi/OTW1bk3FwErVvHcT3P4OFCrJZlHES8Vd+jU:0xZ1bk1FVvHcT/dFCrJRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1252-51-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/2028-49-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2028-50-0x00000000001F0000-0x0000000000206000-memory.dmp

Download

memory/2028-0-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2676-53-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-55-0x0000000000401000-0x000000000041A000-memory.dmp

Download

memory/2676-35-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-34-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-33-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2676-27-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-24-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-22-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2676-20-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2764-56-0x0000000000400000-0x0000000000416000-memory.dmp

Download