6b9b0c2be545dc060c19760fb7437a2661c50797797faa167a4b00a9236d4f29 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 06:36

Sharing

Report Analysis Logs

General

Target

HBCD/WinTools/DTemp.bat
Size

96B
MD5

df678211f71a4c06492c718da2e8f09f
SHA1

b280a8e803553671b05892b8949fd67ec61dfd89
SHA256

a290facbfb11a3554ce2c2dc3e0be3ef3dd771ffaa28ee79fc6dcdd24d074590
SHA512

323d16076685f079f323764565a2244eb0246928e8e298f5be2d61db4ac8924f79d70a58a6c0092a01cc78cfec43c74aac6a926db5a0deca049a9fca5896ade5

Score

7^/10

Malware Config

Signatures

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral21/memory/2936-0-0x0000000000400000-0x000000000047D000-memory.dmp upx
behavioral21/memory/2936-8-0x0000000000400000-0x000000000047D000-memory.dmp upx
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

uharc.exe

pid process

2936 uharc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2176 wrote to memory of 2936	2176	cmd.exe	uharc.exe
PID 2176 wrote to memory of 2936	2176	cmd.exe	uharc.exe
PID 2176 wrote to memory of 2936	2176	cmd.exe	uharc.exe
PID 2176 wrote to memory of 2936	2176	cmd.exe	uharc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\DTemp.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe
..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\files.uha dtemp*
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2936-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2936-8-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download