6b9b0c2be545dc060c19760fb7437a2661c50797797faa167a4b00a9236d4f29 | Triage

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 06:36

Sharing

Report Analysis Logs

General

Target

HBCD/WinTools/AsteriskLogger.bat
Size

101B
MD5

7ef7c686018ac499743387a191b72d47
SHA1

925d6476874f791d3006de07f3c274dc363473fb
SHA256

47881a40db65e4c0b62f60614d2d7dcd31fbf8288f3e52e6bddcc6a437a690ec
SHA512

7a63b5a4ef554a006efdbe5209758d63feb73d674b033be351c4d5558e084debe93503737d6661f9191e0ccc6611147c31ccd3aa06ac3d77e6c56944b1cde2a0

Score

7^/10

Malware Config

Signatures

UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

behavioral3/memory/2116-0-0x0000000000400000-0x000000000047D000-memory.dmp upx
behavioral3/memory/2116-4-0x0000000000400000-0x000000000047D000-memory.dmp upx
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

uharc.exe

pid process

2116 uharc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 948 wrote to memory of 2116	948	cmd.exe	uharc.exe
PID 948 wrote to memory of 2116	948	cmd.exe	uharc.exe
PID 948 wrote to memory of 2116	948	cmd.exe	uharc.exe
PID 948 wrote to memory of 2116	948	cmd.exe	uharc.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HBCD\WinTools\AsteriskLogger.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\HBCD\uharc.exe
..\uharc.exe x -t"C:\Users\Admin\AppData\Local\Temp" -y+ files\files.uha astlog.exe
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2116

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-0-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2116-4-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download