91ce11dba631a9613d7c96409db89bf0cc358eff124632ad56f25fd6b372b070

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/02/2025, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FATR8760090000.exe
Size 1.2MB
Sample250204-kd957asphp
SHA256 91ce11dba631a9613d7c96409db89bf0cc358eff124632ad56f25fd6b372b070
MD5 3078ac39261cb67ff4f82e51ac9b74fd
SHA1 a5743a8afe5157887e031091cea3187fe8f29d51
SHA512 ebd9baf16ac0bedbaf26fa79d9539f8245668a6d9175f61e43c58ccceeea70152ea127822e196acfc391e88b31f70942aff635afdf45d30573436dafa94924ab
SSDEEP 24576:fAHnh+eWsN3skA4RV1Hom2KXFmIal7PJT9C0VXLQZ77r65:Ch+ZkldoPK1Xal7PJTQ0477E
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000016d30-41.dat	acprotect

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\flexuosely.vbs	flexuosely.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	flexuosely.exe

Loads dropped DLL 2 IoCs

pid	Process
1980	FATR8760090000.exe
2476	svchost.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000016d1f-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2476	2404	flexuosely.exe	31

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-44-0x00000000752E0000-0x0000000075349000-memory.dmp	upx
behavioral1/files/0x0007000000016d30-41.dat	upx
behavioral1/memory/2476-47-0x00000000752E0000-0x0000000075349000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FATR8760090000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flexuosely.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2404	flexuosely.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1980	FATR8760090000.exe
1980	FATR8760090000.exe
2404	flexuosely.exe
2404	flexuosely.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1980	FATR8760090000.exe
1980	FATR8760090000.exe
2404	flexuosely.exe
2404	flexuosely.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2404	1980	FATR8760090000.exe	30
PID 1980 wrote to memory of 2404	1980	FATR8760090000.exe	30
PID 1980 wrote to memory of 2404	1980	FATR8760090000.exe	30
PID 1980 wrote to memory of 2404	1980	FATR8760090000.exe	30
PID 2404 wrote to memory of 2476	2404	flexuosely.exe	31
PID 2404 wrote to memory of 2476	2404	flexuosely.exe	31
PID 2404 wrote to memory of 2476	2404	flexuosely.exe	31
PID 2404 wrote to memory of 2476	2404	flexuosely.exe	31
PID 2404 wrote to memory of 2476	2404	flexuosely.exe	31

C:\Users\Admin\AppData\Local\Temp\FATR8760090000.exe
"C:\Users\Admin\AppData\Local\Temp\FATR8760090000.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Glagolitic\flexuosely.exe
  "C:\Users\Admin\AppData\Local\Temp\FATR8760090000.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\FATR8760090000.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

roundups

Path C:\Users\Admin\AppData\Local\Temp\roundups
Size 261KB
SHA256 101c19378acefd7fa5722432b542422e93906b21497c6a7f2f65b37b7c2d91d8
MD5 2d631badcfb25adc786a1a36257fa47a
SHA1 feed8b60b15aa81b24d731aba77342c880710e6d
SHA512 83608b57d77a6db718f3d498bd8c288b4c5c91387d010be777c0b96acc281c23228ce6787c0e5ba9dbb75040e0f4aa95d3a3519ccd9119b7ac96f860736bcfce
SSDEEP 192:XPcvdnnnXsdnnnnnm3onnnnnnKnnnnnUcDnnnnnmDWonnnnnOEnnnnnUc7nnnnnC:i
MD5 SHA1 SHA512 SSDEEP

Submit Download

flexuosely.exe

Path \Users\Admin\AppData\Local\Glagolitic\flexuosely.exe
Size 1.2MB
SHA256 91ce11dba631a9613d7c96409db89bf0cc358eff124632ad56f25fd6b372b070
MD5 3078ac39261cb67ff4f82e51ac9b74fd
SHA1 a5743a8afe5157887e031091cea3187fe8f29d51
SHA512 ebd9baf16ac0bedbaf26fa79d9539f8245668a6d9175f61e43c58ccceeea70152ea127822e196acfc391e88b31f70942aff635afdf45d30573436dafa94924ab
SSDEEP 24576:fAHnh+eWsN3skA4RV1Hom2KXFmIal7PJT9C0VXLQZ77r65:Ch+ZkldoPK1Xal7PJTQ0477E
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbsqlite3.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MXQFNXLT-Admin\vbsqlite3.dll
Size 161KB
SHA256 dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
MD5 073a17b6cfb1112c6c838b2fba06a657
SHA1 a54bb22489eaa8c52eb3e512aee522320530b0be
SHA512 5bc8307350bd8ba09fa9eedddc62f1dba65db62eb09ae64e0adff4dfad0937dbec5b621f294f5980bf77033faac3bfe200945c0280606915ee9a82d34a003b9e
SSDEEP 3072:eNFwdmspaPg9g9oOavAQBNrPkVdc88GjU+vF6nuxRocX5GOOUleo+c:e8d1/w5KA81IJ8GpF6nuTmOOU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1980-11-0x0000000000D80000-0x0000000001180000-memory.dmp

Download

memory/2404-31-0x0000000000BD0000-0x0000000000FD0000-memory.dmp

Download

memory/2476-33-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2476-35-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2476-44-0x00000000752E0000-0x0000000075349000-memory.dmp

Download

memory/2476-45-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/2476-47-0x00000000752E0000-0x0000000075349000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads