Analysis
-
max time kernel
21s -
max time network
129s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24/11/2020, 02:32
General
-
Target
e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe
-
Size
7.2MB
-
MD5
737f4d07b9bb5435fd670f956030d01f
-
SHA1
f608b036034549486d563a59265c1c3bb9466fe0
-
SHA256
e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1
-
SHA512
7c2f3a30bbd1f26a555d7ada2ea4e45a8461ea11ac4ec7552fbd85f545afae16cecac21319f9a6df770cdca8f2785162a03bc8cec5fcf0da3e69a540e0900427
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe"C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Upgrader4.exeC:\Users\Admin\AppData\Local\Temp\Upgrader4.exe C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe +/afterupgrade02⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exeC:\Users\Admin\AppData\Local\Temp\e247b061c89190fa7fec3ce419b3ed58e088db8a58fa40fc208d3995b149adb1.exe /afterupgrade3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-