cca0b8ac2bdc6e900888b1970b2aa05d3b987bda8c4be17f01c0fa69eb3b7baf

Analysis

max time kernel
82s
max time network
68s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

İllegalChecker.exe
Size

12.8MB
MD5

af07c2cf51596a75173523156e27297f
SHA1

9f205a5a6e4ce65d3d313b1f5c160412fa04d58e
SHA256

cca0b8ac2bdc6e900888b1970b2aa05d3b987bda8c4be17f01c0fa69eb3b7baf
SHA512

1bf467eb605f8dcdca18c5aec8402a7184b806737465fe2d1b2413d01cacccec8cee3a51e8523396d332dbacf1ce5b4b3aaa92f4475c9cd781bba6b9ad89bf08
SSDEEP

393216:UJdkewtByxjBIn8iK1piXLGVEgMoEODXXs5kYHZsbAo:U+tAjhDiXHjoRLAsbAo

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2876	İllegalChecker.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a4b4-61.dat	upx
behavioral1/memory/2876-63-0x000007FEF5650000-0x000007FEF5CB3000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2876	2080	İllegalChecker.exe	31
PID 2080 wrote to memory of 2876	2080	İllegalChecker.exe	31
PID 2080 wrote to memory of 2876	2080	İllegalChecker.exe	31

C:\Users\Admin\AppData\Local\Temp\İllegalChecker.exe
"C:\Users\Admin\AppData\Local\Temp\İllegalChecker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\İllegalChecker.exe
  "C:\Users\Admin\AppData\Local\Temp\İllegalChecker.exe"
  2⤵
  - Loads dropped DLL
  PID:2876

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2688

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\CompleteGroup.cfg
1⤵
- Modifies registry class
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20802\python313.dll

Filesize
1.8MB

MD5
d99ac8bac1343105b642295397ca2ffc

SHA1
93fd73c1fb9ee99ddc66d38885a657cf81f62836

SHA256
9116e56cedeb1c4ae82b4bde560f2fe0b83a16764865012cbf5501673d3c5536

SHA512
89d30bc84978daf469008ffc347cbd3e189f1df2c1a302dedfc2b700267cc28c671c7c35b5e95ba29a300e7fda75ccfc720d2173ea6db6eb69978772c0b8339f

Download Submit
memory/2876-63-0x000007FEF5650000-0x000007FEF5CB3000-memory.dmp

Filesize
6.4MB

Download
memory/2876-64-0x000007FEF5650000-0x000007FEF5CB3000-memory.dmp

Filesize
6.4MB

Download