Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 02:36

General

  • Target

    Built.exe

  • Size

    8.4MB

  • MD5

    0c86d73d42f5caf623b9f4d7afb660cf

  • SHA1

    8dcb47b711f5f95d1b0d65fb5af14fcefdb9b402

  • SHA256

    9d0dcb19f263573b2c7fd3e6fa6d5e06464bc10b371b6bde6e381a309022f551

  • SHA512

    812c200512b4e2b5ffce4f13525b2b7e4f2fd3ebc8dd6eb8a959c08b20afa0dfd4281f2112b786165dfeb04940adfe86eb019fd48b7f5f8dbe4c03aa57bb4a9f

  • SSDEEP

    196608:501dIwfI9jUCnORird1Kp0RLOYFSEcN2oc+nBIdAx2:6zIHOQ7nE1nnBIl

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 14 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2152
    • \??\c:\users\admin\appdata\local\temp\built.exe 
      c:\users\admin\appdata\local\temp\built.exe 
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2704
      • \??\c:\users\admin\appdata\local\temp\built.exe 
        c:\users\admin\appdata\local\temp\built.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1660
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3004
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2664
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2040
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1920
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1632
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:38 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:320
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:39 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2120
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:40 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2788
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:1704

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI27042\api-ms-win-core-file-l2-1-0.dll

      Filesize

      18KB

      MD5

      bfffa7117fd9b1622c66d949bac3f1d7

      SHA1

      402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

      SHA256

      1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

      SHA512

      b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

    • C:\Users\Admin\AppData\Local\Temp\_MEI27042\api-ms-win-core-localization-l1-2-0.dll

      Filesize

      21KB

      MD5

      724223109e49cb01d61d63a8be926b8f

      SHA1

      072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

      SHA256

      4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

      SHA512

      19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

    • C:\Users\Admin\AppData\Local\Temp\_MEI27042\api-ms-win-core-processthreads-l1-1-1.dll

      Filesize

      21KB

      MD5

      517eb9e2cb671ae49f99173d7f7ce43f

      SHA1

      4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

      SHA256

      57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

      SHA512

      492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

    • C:\Users\Admin\AppData\Local\Temp\_MEI27042\api-ms-win-core-timezone-l1-1-0.dll

      Filesize

      21KB

      MD5

      d12403ee11359259ba2b0706e5e5111c

      SHA1

      03cc7827a30fd1dee38665c0cc993b4b533ac138

      SHA256

      f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

      SHA512

      9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

    • C:\Users\Admin\AppData\Local\Temp\_MEI27042\python312.dll

      Filesize

      1.7MB

      MD5

      3c5c6c489c358149c970b3b2e562be5f

      SHA1

      2f1077db20405b0a176597ed34a10b4730af3ca9

      SHA256

      73a22a12ea3d7f763ed2cea94bb877441f4134b40f043c400648d85565757741

      SHA512

      d3fb4e5df409bf2de4f5dc5d02d806aee649a21c339c648248b835c3d5d66ab88312c076c149eaadaa3ce0fb43e6fa293bfa369d8876d6eb18742bd9d12448e3

    • C:\Users\Admin\AppData\Local\Temp\_MEI27042\ucrtbase.dll

      Filesize

      992KB

      MD5

      0e0bac3d1dcc1833eae4e3e4cf83c4ef

      SHA1

      4189f4459c54e69c6d3155a82524bda7549a75a6

      SHA256

      8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

      SHA512

      a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      930908ce154170c198cbea2a4ece7e4d

      SHA1

      6b958e18736a1f444f4b0966aed1069913a40f5e

      SHA256

      d9d0f6db0465e6de6b734804b7b84a4fcfa6103e9f3d1fcbae938f1a1fef110a

      SHA512

      5ab81ae89ff7d2d8942a1d0a938da60dfb9a1793a204ddc4a37053babbd202bf874f891a48c696159a5cf66e663c571b1635433472d63c2c87f86b74977cf8ae

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      04dd8e13f1b9ba8123208e3cd466203a

      SHA1

      c108c8e5b3cf9489b007db55388728e090e159a7

      SHA256

      e6c9e658dbd9ccaad99a00922b62d81f37d1b4dc133bdc08521bbf18c92be2d7

      SHA512

      291ac6df2264b067db23c8d94bff240c8bd5f06a12d61acebba6398ec86aa77a3b5e78f7380e79224b075727a4d1f07c329b9bee24e34e9c85146d96ef3fa6b2

    • \??\c:\windows\resources\svchost.exe

      Filesize

      135KB

      MD5

      e01737d14d70ec5f4cc1afff6ec2b5c0

      SHA1

      7617f81c60d465b1aa9ee7653976a700c39d1bff

      SHA256

      ffbc46feb41bf37e37851481580fb3e86eb610beb67e4bfbefbb307286afd8af

      SHA512

      eab7d8bf27c4c3bedba74deaaa15c1362e5e042abbe6666dd725a5a1af485a5f3dd6e625dc7e9f3e564eda860dd8b110709f022107f67069c5d5d76e0fa978f7

    • \Users\Admin\AppData\Local\Temp\_MEI27042\api-ms-win-core-file-l1-2-0.dll

      Filesize

      21KB

      MD5

      1c58526d681efe507deb8f1935c75487

      SHA1

      0e6d328faf3563f2aae029bc5f2272fb7a742672

      SHA256

      ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

      SHA512

      8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

    • \Users\Admin\AppData\Local\Temp\built.exe 

      Filesize

      8.3MB

      MD5

      ab092955e039b2d8498904e6e382abd4

      SHA1

      19bb52f1bd637ad0a38123a054ade4f41dfafe3a

      SHA256

      16534683d0ae64e39fa5b59dd5d82089f8f77debc61c17dc2c2b42bc2596fe27

      SHA512

      8baa620582ac0c9eb4ee61de978e764a5cb82d351a5125bf947bdb8faf7a8f313f10a21ca4ee6bb08674e8e821fb34576ce5164b1b29072d80cb160f24215c0f

    • \Windows\Resources\Themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      297929d04018c5524cd9aabfaaa7198a

      SHA1

      95f06d03e9ede826bfe482eaa09e9ab66eb1c585

      SHA256

      490c61b0f669580231766a19db0520ef865c322810d7ed48852da88b39ad8aea

      SHA512

      0227c1bab1e81b69a20f1ad9d177a5d428e74a5592438076bdf2b0bf1f51ba8f3e8cbf5e9d0a047db7201d9dad4f32d8d111f2ef06c6af8650b3de2855eb5f8d

    • memory/1632-135-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1632-137-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1660-141-0x000007FEF59B0000-0x000007FEF6071000-memory.dmp

      Filesize

      6.8MB

    • memory/1660-91-0x000007FEF59B0000-0x000007FEF6071000-memory.dmp

      Filesize

      6.8MB

    • memory/1920-127-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1920-196-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1920-134-0x0000000000300000-0x000000000031F000-memory.dmp

      Filesize

      124KB

    • memory/1920-197-0x0000000000300000-0x000000000031F000-memory.dmp

      Filesize

      124KB

    • memory/2040-116-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2040-138-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2152-139-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2152-77-0x0000000000300000-0x000000000031F000-memory.dmp

      Filesize

      124KB

    • memory/2152-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-195-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3004-140-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3004-103-0x0000000000350000-0x000000000036F000-memory.dmp

      Filesize

      124KB