Analysis

  • max time kernel
    118s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 01:29

General

  • Target

    48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe

  • Size

    102KB

  • MD5

    0e540262593387d5ef74e5ea9b1cf920

  • SHA1

    9b2b9467a84d4696820879a5e1dc229584770de0

  • SHA256

    48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bf

  • SHA512

    ca9c4815a571c27a68ddafdeec0523741639e477e6df95da04be035812b5d2990cc186264fbf10dbd45905b4a140bad97c454b9e90b0bcdc7abf2139f85fdec0

  • SSDEEP

    3072:xFphTfm1UC7AdYzrV+Dljy/32ubwZZqJ:FhTfmuCkdYzrVolu/J0ZZ

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
    "C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe
      "C:\Users\Admin\AppData\Local\Temp\48f03a18b1dfc823a41d6aae282332a571e7ec5d6743af9ff83ea6529677e5bfN.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3092
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BNROC.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:3312
      • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
        "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3336
        • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
          "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:348
        • C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe
          "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BNROC.bat

    Filesize

    157B

    MD5

    f6a90c20834f271a907a4e2bc28184c2

    SHA1

    36c9d1602b74f622346fbb22693597d7889df48d

    SHA256

    73f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd

    SHA512

    39cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804

  • \Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe

    Filesize

    102KB

    MD5

    14fa923440f4f8ed41957128c11bc64f

    SHA1

    2249d4d186fd68542785798c37c34965b651a7ab

    SHA256

    b457539bf4cfcaa32185f6899cbdfb43478df7ca031536532bd3e0c10ce18994

    SHA512

    30d8effa49ed51a2262992635d9559da8a16fa10c031ed8831e83b9573ac74aef25be91a71e2d43bf9026132b493ade456b884d8988daf9c6d78a6c376ccebf4

  • memory/348-1054-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/348-1036-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2100-0-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2100-3-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2100-27-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2100-26-0x0000000000409000-0x000000000040A000-memory.dmp

    Filesize

    4KB

  • memory/2100-25-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2100-286-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/2100-430-0x0000000002AB0000-0x0000000002AEB000-memory.dmp

    Filesize

    236KB

  • memory/2100-450-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3092-491-0x00000000030D0000-0x000000000310B000-memory.dmp

    Filesize

    236KB

  • memory/3092-498-0x00000000030D0000-0x000000000310B000-memory.dmp

    Filesize

    236KB

  • memory/3092-489-0x00000000030D0000-0x000000000310B000-memory.dmp

    Filesize

    236KB

  • memory/3092-488-0x00000000030C0000-0x00000000030FB000-memory.dmp

    Filesize

    236KB

  • memory/3092-487-0x00000000030C0000-0x00000000030FB000-memory.dmp

    Filesize

    236KB

  • memory/3092-496-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3092-499-0x00000000030D0000-0x000000000310B000-memory.dmp

    Filesize

    236KB

  • memory/3092-490-0x00000000030D0000-0x000000000310B000-memory.dmp

    Filesize

    236KB

  • memory/3092-497-0x00000000030C0000-0x00000000030FB000-memory.dmp

    Filesize

    236KB

  • memory/3092-1049-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3092-444-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3336-493-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3336-1035-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/3336-1047-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB