9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40

Resubmissions

26-04-2024 07:51

240426-jp4xwacb3v 10

26-04-2024 07:51

26-04-2024 07:51

26-04-2024 07:51

26-04-2024 07:51

25-04-2024 12:59

Analysis

max time kernel
346s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
Size

1.9MB
MD5

1457ef90efde49a7ee83080ce051d6f7
SHA1

8ca6d983fe2997fa7009458383b84e0d1edeb279
SHA256

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40
SHA512

582628e02510812e0ed06cc05a1bfb98e96f019935efb71d23dd94745a0c5db12771bf0c81579dd7ad4f44b90e7192b95d5d2ed4a6649adc00b486c28df643d0
SSDEEP

49152:Vbe6aahW7iaBUHvG+vxz90ChL0WF+UIGDDS/NL:vaaA7iYb+dtQWFZvSR

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Contacts a large (848) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/1204-3-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-5-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-6-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-7-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-8-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-9-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-14-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-15-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-16-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-17-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-18-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-27-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-30-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-31-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-35-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-36-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-37-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-39-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-40-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-50-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-59-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-60-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-61-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-62-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-66-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-67-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-68-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-70-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-72-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-77-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-78-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-76-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-75-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-73-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-80-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-81-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-87-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-89-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-88-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-83-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-85-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-91-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-92-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-93-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-98-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-100-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-107-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-106-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-104-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-103-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-101-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-96-0x0000000000400000-0x0000000000848000-memory.dmp	upx
behavioral4/memory/1204-97-0x0000000000400000-0x0000000000848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CSRSS = "\"C:\\ProgramData\\Drivers\\csrss.exe\""	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

3828 discord.com
3852 discord.com
3931 discord.com
4092 discord.com
4109 discord.com
4409 discord.com

flow	ioc
3828	discord.com
3852	discord.com
3931	discord.com
4092	discord.com
4109	discord.com
4409	discord.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	pid	process	target process
PID 3788 set thread context of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

pid	process
1204	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
1204	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
1204	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
1204	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
1204	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
1204	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

description	pid	process	target process
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
PID 3788 wrote to memory of 1204	3788	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe	9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe

C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
"C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3788

C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe
"C:\Users\Admin\AppData\Local\Temp\9bb0954a71edfd122a5e2b14850702a453fdbf5a632265337c0aee558bdd3e40.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp
Filesize
2.5MB

MD5
a71659bcabc3b32eed883c95c44b1a62

SHA1
eb0af3adaf524b61490f01e5ae86cfee0bd18663

SHA256
be1ab31af3ff4cec23c0d093e66964ad6e18028e80aa98de834aa6fbe8b598e1

SHA512
0cb24ac55861b5d97658f110525b62803ef9190e7274fb908ff8de9f05e1369d8d8a535d8f8c01e33b5498cc4acb18e0cf7be3b76dc3c6fdad78090d9fbba1dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new
Filesize
5.3MB

MD5
be2d543c65513f6a4d0dff1b328032c3

SHA1
143ae24f00f76416cccfe6bd9d9f7c5ffa8a5cf0

SHA256
6580f1aae742f9508f656f6fa4dff3a00ca4953e31433a391c7700c93c8b6b30

SHA512
8cedd47b8d7c0ee70e45601cc15186e6f13126d1b13cf5bbaf3b307f891ceee4d530989ca16ddb8148be0a9b6ea3ff5633675a84eb51975f8104c8438d7b9480

Download Submit
memory/1204-3-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-5-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-6-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-7-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-8-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-9-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-14-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-15-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-16-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-17-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-18-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-27-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-30-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-31-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-35-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-36-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-37-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-39-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-40-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-50-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-59-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-60-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-61-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-62-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-66-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-67-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-68-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-70-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-72-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-77-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-78-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-76-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-75-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-73-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-80-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-81-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-87-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-89-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-88-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-83-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-85-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-91-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-92-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-93-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-98-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-100-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-107-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-106-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-104-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-103-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-101-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-96-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1204-97-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/3788-1-0x00000000027A0000-0x0000000002964000-memory.dmp

Filesize
1.8MB

Download
memory/3788-2-0x0000000002970000-0x0000000002B27000-memory.dmp

Filesize
1.7MB

Download