Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 06:28
Behavioral task
behavioral1
Sample
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe
Resource
win7-20240220-en
General
-
Target
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe
-
Size
12.9MB
-
MD5
8fd64dc85a9bd1a9c54acc6fc495221f
-
SHA1
f40e9913e38058e5d33fe2e294fdef1228acfd61
-
SHA256
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a
-
SHA512
33b118da33753cb1699b6d4da30581fbde8ad338be716eb232527dd19a9db16ca07af3e1a1c9de62ac95cd7c9271e047ad8a06cfa7805304cce8707c9cd92392
-
SSDEEP
393216:w9PRaCrKqXsEU6oxUTMCoRCREOUi4JDj:w9Jj5XagoRCCO9i
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
PL630ovKI4.exepid process 1580 PL630ovKI4.exe -
Loads dropped DLL 2 IoCs
Processes:
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exepid process 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe -
Processes:
resource yara_rule behavioral1/memory/3040-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-65-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-63-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-59-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3040-42-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/3040-0-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect behavioral1/memory/3040-36-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect behavioral1/memory/3040-40-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect behavioral1/memory/3040-84-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect behavioral1/memory/3040-88-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect behavioral1/memory/3040-90-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\PL630ovKI4.exe vmprotect behavioral1/memory/3040-99-0x0000000000400000-0x0000000001EDD000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exePL630ovKI4.exepid process 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 1580 PL630ovKI4.exe 1580 PL630ovKI4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exePL630ovKI4.exedescription pid process Token: SeDebugPrivilege 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe Token: SeDebugPrivilege 1580 PL630ovKI4.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exePL630ovKI4.exepid process 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe 1580 PL630ovKI4.exe 1580 PL630ovKI4.exe 1580 PL630ovKI4.exe 1580 PL630ovKI4.exe 1580 PL630ovKI4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exedescription pid process target process PID 3040 wrote to memory of 1580 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe PL630ovKI4.exe PID 3040 wrote to memory of 1580 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe PL630ovKI4.exe PID 3040 wrote to memory of 1580 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe PL630ovKI4.exe PID 3040 wrote to memory of 1580 3040 abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe PL630ovKI4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe"C:\Users\Admin\AppData\Local\Temp\abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PL630ovKI4.exe"C:\Users\Admin\AppData\Local\Temp\PL630ovKI4.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PL630ovKI4.exeFilesize
12.9MB
MD58fd64dc85a9bd1a9c54acc6fc495221f
SHA1f40e9913e38058e5d33fe2e294fdef1228acfd61
SHA256abdfd28827f1e7c092708e1a0be2477d979abf995646666e933c5a885133bf9a
SHA51233b118da33753cb1699b6d4da30581fbde8ad338be716eb232527dd19a9db16ca07af3e1a1c9de62ac95cd7c9271e047ad8a06cfa7805304cce8707c9cd92392
-
C:\Users\Admin\AppData\Local\Temp\debug.iniFilesize
99B
MD5610ee17de0fdd9124bdfb995049fef00
SHA13ca132d470a0f6eafb5abbebe8fbef23a9a09f53
SHA256f33abef252234451e9aeb777812160997944ece7ef048e98459e1eb8a96f5c52
SHA512eb678fb82f0aa77d75da761a00cdc990c6ef697cec60fc1a9d3876a566810837a77e757e31ea15b4b63b1c41c595a11630a5c366f3d589e8b95c039a414212ba
-
memory/3040-65-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-20-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/3040-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-30-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3040-28-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3040-25-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/3040-23-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/3040-63-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-18-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/3040-15-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3040-13-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3040-10-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3040-0-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-6-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3040-5-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3040-3-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3040-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3040-36-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-40-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-8-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3040-33-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3040-31-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3040-59-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-57-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-55-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-53-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-51-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3040-84-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-88-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-90-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-35-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3040-99-0x0000000000400000-0x0000000001EDD000-memory.dmpFilesize
26.9MB
-
memory/3040-98-0x0000000000EF9000-0x00000000011FB000-memory.dmpFilesize
3.0MB
-
memory/3040-101-0x00000000073E0000-0x0000000008EBD000-memory.dmpFilesize
26.9MB
-
memory/3040-102-0x00000000073E0000-0x0000000008EBD000-memory.dmpFilesize
26.9MB
-
memory/3040-37-0x0000000000EF9000-0x00000000011FB000-memory.dmpFilesize
3.0MB