Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 07:08
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
Built.exe
-
Size
6.9MB
-
MD5
d772e1efa7b94af9ee80dd8e9e8a85ca
-
SHA1
775f4af3e6d0c509dff1d1d196dec5fc9c0c3124
-
SHA256
532728294399998f9c5bcc6e8dbb864850a03e860dd2e7d675bf93c5caa4e11e
-
SHA512
74bac02d02d3eee866e1fda3a9d176070d20118418404bfb8d98d3175b3c370148e62fcc24c998dd27d992df22792348dcea3eaf63497fc2c82ed9c1b34f848e
-
SSDEEP
98304:q9izdbM+Q2y+aoWfjOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/Bb2EJ1nL2hB0LnuS:qScOjmFQR4MVGFtwLPmnL2hqJ
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2348 Built.exe -
resource yara_rule behavioral1/files/0x0005000000019268-21.dat upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2800 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2800 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe 2800 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2348 2452 Built.exe 31 PID 2452 wrote to memory of 2348 2452 Built.exe 31 PID 2452 wrote to memory of 2348 2452 Built.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Built.exe"C:\Users\Admin\AppData\Local\Temp\Built.exe"2⤵
- Loads dropped DLL
PID:2348
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2800
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD59e985651962ccbccdf5220f6617b444f
SHA19238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA2563373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA5128b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36