37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29

Analysis

max time kernel
89s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
Size 1003KB
Sample250127-scrapavkdr
SHA256 37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29
MD5 7c99d680f96617b65215ccd917a2adc0
SHA1 f29e15f517b6af991d058141974d3b560053cff9
SHA512 f5a82e01afa774b76248221fb4f90acf87c41bb4029a4b19d010b22cf1bdd750f59c5f2e4d7a969419c1eafb4b825414dc708fcba9f00a9dd114e1e96751da6d
SSDEEP 24576:OJny+8ZjOb8k4Nq+IVCheaEY3ZRDfhx5rpC77DfEb2dzb:ONF9b8ELVCheadJRbhx5rpC7sb2dzb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe

Executes dropped EXE 1 IoCs

pid	Process
1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
11	pastebin.com

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3892-0-0x0000000000400000-0x000000000065C000-memory.dmp	upx
behavioral2/files/0x000a000000023c7e-12.dat	upx
behavioral2/memory/1788-14-0x0000000000400000-0x000000000065C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4644	1788	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
536	schtasks.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3892	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3892	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 1788	3892	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	84
PID 3892 wrote to memory of 1788	3892	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	84
PID 3892 wrote to memory of 1788	3892	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	84
PID 1788 wrote to memory of 536	1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	85
PID 1788 wrote to memory of 536	1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	85
PID 1788 wrote to memory of 536	1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	85
PID 1788 wrote to memory of 1296	1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	87
PID 1788 wrote to memory of 1296	1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	87
PID 1788 wrote to memory of 1296	1788	37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe	87
PID 1296 wrote to memory of 3664	1296	cmd.exe	89
PID 1296 wrote to memory of 3664	1296	cmd.exe	89
PID 1296 wrote to memory of 3664	1296	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
"C:\Users\Admin\AppData\Local\Temp\37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
  C:\Users\Admin\AppData\Local\Temp\37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe" /TN 8vKW9zOD7b0e /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN 8vKW9zOD7b0e > C:\Users\Admin\AppData\Local\Temp\7V1xN.xml
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN 8vKW9zOD7b0e
      4⤵
      System Location Discovery: System Language Discovery
      PID:3664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 612
    3⤵
    - Program crash
    PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1788 -ip 1788
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe

Path C:\Users\Admin\AppData\Local\Temp\37cdf918bce1b980fca8cff4c4a025063f59fc24b4ebc31115fb1edb4b809f29N.exe
Size 1003KB
SHA256 3bbf81115a95e9f5a905b2fcb988efe01603d4068bdab94d0d0a5746f813a51b
MD5 027ca6d7871baf77b348ea33913117cb
SHA1 3256ac442bc9d6e2f3d00530c9413e06c2b9f06f
SHA512 02a7aac6a015fba76f586504762bc28e79f043094524c69b6f52718a2f78310a85e75c4ce005e75e0d295318e519628f63c7119d65619972a11b55503eb8581d
SSDEEP 24576:7ZwXhL63Ix48xxJZRDfhx5rpC77DfEb2dzb:7ZwXhLHxhXrRbhx5rpC7sb2dzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

7V1xN.xml

Path C:\Users\Admin\AppData\Local\Temp\7V1xN.xml
Size 1KB
SHA256 cf8c1bc2827390dbb36bc1e863d73794c05407d9f88e5799954141146a18cd74
MD5 06dd9d0f1bda6ec5d11a1f7373660761
SHA1 3ef4f7963a3cc27088b8e74d64dd7235974b38e7
SHA512 714f84c95575a63411ba4aee6729cc9d2c3c0a43e23ce005f5d6d0117b7ba701cc9b81f71ad7b42be16de9eb261610bb7adc2e3fcbbf17d6eee31235468be8f2
MD5 SHA1 SHA512

Submit Download

memory/1788-14-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/1788-21-0x0000000001720000-0x000000000179E000-memory.dmp

Download

memory/1788-22-0x0000000000470000-0x00000000004DB000-memory.dmp

Download

memory/1788-23-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1788-44-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/3892-0-0x0000000000400000-0x000000000065C000-memory.dmp

Download

memory/3892-1-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/3892-7-0x0000000025010000-0x000000002508E000-memory.dmp

Download

memory/3892-13-0x0000000000400000-0x000000000046B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads