eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6

Analysis

max time kernel
104s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/01/2025, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
Size

392KB
MD5

62a9d7c5d20e3f9e8921fdd8c1e0222f
SHA1

9dc5462a4716656fcb308127f457b1a2b249ec8f
SHA256

eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6
SHA512

6e688319bafebf6f1c4ae0ed0aeb604f43f97167ee11fdcd0234e7be7f60d5e027fafa675417c6c1fa587f2590dc72eec2bef6dde22841b55297165dd63ffec0
SSDEEP

3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV2f:DPA6wxmuJspr2lb6W

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2680	skyrpe.exe
169976	skyrpe.exe

Loads dropped DLL 5 IoCs

pid	Process
3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 576 set thread context of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 2680 set thread context of 169976	2680	skyrpe.exe	35

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/576-0-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/576-223-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/3248-53493-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/576-53492-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/3248-53491-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/3248-53490-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/3248-53485-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/3248-53483-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0013000000016d3f-53518.dat	upx
behavioral1/memory/3248-53687-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2680-53692-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/2680-106979-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/3248-106982-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skyrpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skyrpe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
2680	skyrpe.exe
169976	skyrpe.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 576 wrote to memory of 3248	576	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	30
PID 3248 wrote to memory of 936	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	31
PID 3248 wrote to memory of 936	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	31
PID 3248 wrote to memory of 936	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	31
PID 3248 wrote to memory of 936	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	31
PID 936 wrote to memory of 2676	936	cmd.exe	33
PID 936 wrote to memory of 2676	936	cmd.exe	33
PID 936 wrote to memory of 2676	936	cmd.exe	33
PID 936 wrote to memory of 2676	936	cmd.exe	33
PID 3248 wrote to memory of 2680	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	34
PID 3248 wrote to memory of 2680	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	34
PID 3248 wrote to memory of 2680	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	34
PID 3248 wrote to memory of 2680	3248	eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe	34
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 169976	2680	skyrpe.exe	35
PID 2680 wrote to memory of 44804	2680	skyrpe.exe	36
PID 2680 wrote to memory of 44804	2680	skyrpe.exe	36
PID 2680 wrote to memory of 44804	2680	skyrpe.exe	36
PID 2680 wrote to memory of 44804	2680	skyrpe.exe	36
PID 2680 wrote to memory of 44804	2680	skyrpe.exe	36
PID 2680 wrote to memory of 44804	2680	skyrpe.exe	36

C:\Users\Admin\AppData\Local\Temp\eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
"C:\Users\Admin\AppData\Local\Temp\eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe
  "C:\Users\Admin\AppData\Local\Temp\eed111a1ee7190d2be358a867c59188b2be98cd074e4f7a3b6832a3854ecb6e6.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\NOLTG.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2676
- - C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
    "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
      "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:169976
  - - C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
      "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"
      4⤵
      PID:44804
    - - C:\Windows\syswow64\svchost.exe
        
        C:\Windows\syswow64\svchost.exe
        5⤵
        
        PID:44748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NOLTG.bat

Filesize
139B

MD5
0654f004b2e314bad7f75867e91da37d

SHA1
4232c22e7340b12108d86e3cb35ed288a3dbc7f1

SHA256
ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249

SHA512
dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

Download Submit
\Users\Admin\AppData\Roaming\skype\skyrpe.exe

Filesize
392KB

MD5
d35fbc659e92343d3974ce357be00ea6

SHA1
595f49f26769897207cba6d53fc097b9086ddd7c

SHA256
6a0f2d41886c2c1f434ba01560879841741637cecdb5757df0fe344c89062581

SHA512
56a0d3bb2510f9d28364632a2be4ab6adb9e089cf4139cdccc4988b9f494c11f220d4d754f5bbf463fa32cd9c439e0573746bf7c72c426cef5f615d223822053

Download Submit
memory/576-0-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/576-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/576-178-0x0000000000404000-0x0000000000405000-memory.dmp

Filesize
4KB

Download
memory/576-223-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/576-53492-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/576-53489-0x0000000002520000-0x0000000002582000-memory.dmp

Filesize
392KB

Download
memory/2680-106979-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2680-53692-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3248-53481-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53690-0x0000000002640000-0x00000000026A2000-memory.dmp

Filesize
392KB

Download
memory/3248-53485-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53490-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53491-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53520-0x0000000002640000-0x00000000026A2000-memory.dmp

Filesize
392KB

Download
memory/3248-53534-0x0000000002640000-0x00000000026A2000-memory.dmp

Filesize
392KB

Download
memory/3248-53533-0x0000000002640000-0x00000000026A2000-memory.dmp

Filesize
392KB

Download
memory/3248-53687-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53483-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53691-0x0000000002640000-0x00000000026A2000-memory.dmp

Filesize
392KB

Download
memory/3248-53689-0x0000000002640000-0x00000000026A2000-memory.dmp

Filesize
392KB

Download
memory/3248-53493-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-106982-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-53487-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/44804-106978-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/44804-106985-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads