Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 02:31

General

  • Target

    Built.exe

  • Size

    8.4MB

  • MD5

    0c86d73d42f5caf623b9f4d7afb660cf

  • SHA1

    8dcb47b711f5f95d1b0d65fb5af14fcefdb9b402

  • SHA256

    9d0dcb19f263573b2c7fd3e6fa6d5e06464bc10b371b6bde6e381a309022f551

  • SHA512

    812c200512b4e2b5ffce4f13525b2b7e4f2fd3ebc8dd6eb8a959c08b20afa0dfd4281f2112b786165dfeb04940adfe86eb019fd48b7f5f8dbe4c03aa57bb4a9f

  • SSDEEP

    196608:501dIwfI9jUCnORird1Kp0RLOYFSEcN2oc+nBIdAx2:6zIHOQ7nE1nnBIl

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Built.exe
    "C:\Users\Admin\AppData\Local\Temp\Built.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1852
    • \??\c:\users\admin\appdata\local\temp\built.exe 
      c:\users\admin\appdata\local\temp\built.exe 
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2944
      • \??\c:\users\admin\appdata\local\temp\built.exe 
        c:\users\admin\appdata\local\temp\built.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: GetForegroundWindowSpam
        PID:2648
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1848
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1780
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:392
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:552
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2908
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:33 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2924
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:34 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:2472
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:35 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1688
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:2164

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\api-ms-win-core-file-l1-2-0.dll

      Filesize

      21KB

      MD5

      1c58526d681efe507deb8f1935c75487

      SHA1

      0e6d328faf3563f2aae029bc5f2272fb7a742672

      SHA256

      ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

      SHA512

      8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\api-ms-win-core-file-l2-1-0.dll

      Filesize

      18KB

      MD5

      bfffa7117fd9b1622c66d949bac3f1d7

      SHA1

      402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

      SHA256

      1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

      SHA512

      b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\api-ms-win-core-localization-l1-2-0.dll

      Filesize

      21KB

      MD5

      724223109e49cb01d61d63a8be926b8f

      SHA1

      072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

      SHA256

      4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

      SHA512

      19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\api-ms-win-core-processthreads-l1-1-1.dll

      Filesize

      21KB

      MD5

      517eb9e2cb671ae49f99173d7f7ce43f

      SHA1

      4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

      SHA256

      57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

      SHA512

      492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\api-ms-win-core-timezone-l1-1-0.dll

      Filesize

      21KB

      MD5

      d12403ee11359259ba2b0706e5e5111c

      SHA1

      03cc7827a30fd1dee38665c0cc993b4b533ac138

      SHA256

      f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

      SHA512

      9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\python312.dll

      Filesize

      1.7MB

      MD5

      3c5c6c489c358149c970b3b2e562be5f

      SHA1

      2f1077db20405b0a176597ed34a10b4730af3ca9

      SHA256

      73a22a12ea3d7f763ed2cea94bb877441f4134b40f043c400648d85565757741

      SHA512

      d3fb4e5df409bf2de4f5dc5d02d806aee649a21c339c648248b835c3d5d66ab88312c076c149eaadaa3ce0fb43e6fa293bfa369d8876d6eb18742bd9d12448e3

    • C:\Users\Admin\AppData\Local\Temp\_MEI29442\ucrtbase.dll

      Filesize

      992KB

      MD5

      0e0bac3d1dcc1833eae4e3e4cf83c4ef

      SHA1

      4189f4459c54e69c6d3155a82524bda7549a75a6

      SHA256

      8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

      SHA512

      a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      fa999b354244c8c27ee80ab9e9473b4d

      SHA1

      4cd6b613c6e153bcaf8e81f384ba2c11347516bc

      SHA256

      19404d9d3e44603e668929810983449d9ddf4d708edcf7a6254ec496f47dde30

      SHA512

      3d0819784eb3c060c650e230922ec71b18b5b0f81f674bbc80d03cac7f29211687b4017d2a263a56a87460b9492123bf975b390e5856a83f2f8bb3752b5ae49b

    • C:\Windows\Resources\Themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      297929d04018c5524cd9aabfaaa7198a

      SHA1

      95f06d03e9ede826bfe482eaa09e9ab66eb1c585

      SHA256

      490c61b0f669580231766a19db0520ef865c322810d7ed48852da88b39ad8aea

      SHA512

      0227c1bab1e81b69a20f1ad9d177a5d428e74a5592438076bdf2b0bf1f51ba8f3e8cbf5e9d0a047db7201d9dad4f32d8d111f2ef06c6af8650b3de2855eb5f8d

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      8e5c45350aef3bcce5348109ac5a3542

      SHA1

      37888b55d7902b79ae2b8a965d43aeb7f04673d1

      SHA256

      fcefce90500779d52e9396861fa2d156038085370dc273ba83538d627d2d007e

      SHA512

      75e3c1bfef4d7d342a26909f66ddcd01915dd6c7e318abe2b1a0fa93caa677c82cf8e687c1c303a24534ef0f67a42f9283ac941e83e831ebd17bf1af80dd74c6

    • \Users\Admin\AppData\Local\Temp\built.exe 

      Filesize

      8.3MB

      MD5

      ab092955e039b2d8498904e6e382abd4

      SHA1

      19bb52f1bd637ad0a38123a054ade4f41dfafe3a

      SHA256

      16534683d0ae64e39fa5b59dd5d82089f8f77debc61c17dc2c2b42bc2596fe27

      SHA512

      8baa620582ac0c9eb4ee61de978e764a5cb82d351a5125bf947bdb8faf7a8f313f10a21ca4ee6bb08674e8e821fb34576ce5164b1b29072d80cb160f24215c0f

    • \Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      a83a1f0a07281048d38b4c96f1160a3a

      SHA1

      32f6846fac3537f51835fa6ed5989ffa125c2050

      SHA256

      99f990f4bb333da095d7dd4fff41f0578fbb73e7518e0bd4542f071c6377b8f6

      SHA512

      404d82dab80e69f4a15a6c053a96eb1bf21687edd72d30a980258f4806d06cd59c28b54eed8283a289d218a52772b28dc410b6ed940e3eb1f2d4e60c17fef538

    • memory/392-136-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/552-134-0x00000000002F0000-0x000000000030F000-memory.dmp

      Filesize

      124KB

    • memory/552-141-0x00000000002F0000-0x000000000030F000-memory.dmp

      Filesize

      124KB

    • memory/552-140-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1780-139-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1848-137-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1852-138-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1852-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1852-93-0x0000000000280000-0x000000000029F000-memory.dmp

      Filesize

      124KB

    • memory/2648-133-0x000007FEF61D0000-0x000007FEF6891000-memory.dmp

      Filesize

      6.8MB

    • memory/2648-92-0x000007FEF61D0000-0x000007FEF6891000-memory.dmp

      Filesize

      6.8MB

    • memory/2908-135-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB