Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11-10-2022 22:30
General
-
Target
d23d19798b1868435fd6dfa7feda07637c844f4f4789b0ded9671c196cbfdd25.exe
-
Size
176KB
-
MD5
6817c82b02ff1a2e19d80bcd0e3e927c
-
SHA1
07f4ac6b268ddd6972e95b18ed4a4fcccf17ae26
-
SHA256
d23d19798b1868435fd6dfa7feda07637c844f4f4789b0ded9671c196cbfdd25
-
SHA512
c6579e30e37472a400d727f88bdfd6867276ffbe89e08202235c45dd8741d19ba2ebd83b1cfebde74e68d990ff35312f1f5be638da9951cc0e4b599cc777b7f9
-
SSDEEP
3072:7xbUV/7421tvlPytmjw8YdNuuIN+ZL5mEvnESuifG+3vw+XOSYtVZoAN:8D4EtvlPytm05dPfnBuH+3o+9
Malware Config
Signatures
-
ASPack v2.12-2.42 5 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d23d19798b1868435fd6dfa7feda07637c844f4f4789b0ded9671c196cbfdd25.exe"C:\Users\Admin\AppData\Local\Temp\d23d19798b1868435fd6dfa7feda07637c844f4f4789b0ded9671c196cbfdd25.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\762e2b52.exeC:\762e2b52.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD56b222c20acbdc5a0919ced7d62ae127e
SHA1e5548137ef1150423b571fa0e7ceeb62c7190f56
SHA256582dd6d194571b1399686acd934336238108d1e18e0756223d318d552539bf5a
SHA51297cb5023f43c91ecc3577f270c54f486fb1246970f019a88eb7e2ee77d94b2e37a85a20b70989aca85ca7c18661346f5499e46d8a069f1ef2ad4b9d0233cb815
-
Filesize
90KB
MD56b222c20acbdc5a0919ced7d62ae127e
SHA1e5548137ef1150423b571fa0e7ceeb62c7190f56
SHA256582dd6d194571b1399686acd934336238108d1e18e0756223d318d552539bf5a
SHA51297cb5023f43c91ecc3577f270c54f486fb1246970f019a88eb7e2ee77d94b2e37a85a20b70989aca85ca7c18661346f5499e46d8a069f1ef2ad4b9d0233cb815
-
Filesize
720B
MD5dc0038bd7f38acd92e883bf6030bc460
SHA1cf25b6be5b9c7f71f6d2166b5c5f6db1ea46a60d
SHA2567972afef839599f7a18e7f4fb930bacf13d2f9e0dcc974bce61f844c61a35e53
SHA5124b5f4b6be483ecc72b87e2b1e8438db250a6f7b6074b7a776adf48cf19aaadeb55831ca25532d26e703244de8bc0602945e1f23fdfc7d23db99bd97db7a6a808
-
Filesize
90KB
MD5d9c481df51944891331899940034a2fd
SHA11d86eeec53bc1a4a5e28b69e3faec885dd48fdfa
SHA256e5d4623258e0c70c13ecc444f811c587e7b8191aaefef7773095d082be94737f
SHA5123a3673a3e10d3c4aa74eb902ad3eebc9e20df739b6b5b3c58922e37271a5deff92f6a4c4c790e1e0ba2d3db3f2e920a3253fddf33250fede8aa46552ec3b427a
-
Filesize
90KB
MD5d9c481df51944891331899940034a2fd
SHA11d86eeec53bc1a4a5e28b69e3faec885dd48fdfa
SHA256e5d4623258e0c70c13ecc444f811c587e7b8191aaefef7773095d082be94737f
SHA5123a3673a3e10d3c4aa74eb902ad3eebc9e20df739b6b5b3c58922e37271a5deff92f6a4c4c790e1e0ba2d3db3f2e920a3253fddf33250fede8aa46552ec3b427a
-
Filesize
90KB
MD5d9c481df51944891331899940034a2fd
SHA11d86eeec53bc1a4a5e28b69e3faec885dd48fdfa
SHA256e5d4623258e0c70c13ecc444f811c587e7b8191aaefef7773095d082be94737f
SHA5123a3673a3e10d3c4aa74eb902ad3eebc9e20df739b6b5b3c58922e37271a5deff92f6a4c4c790e1e0ba2d3db3f2e920a3253fddf33250fede8aa46552ec3b427a
-
Filesize
64.0MB
-
-
Filesize
384KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
384KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
180KB
-
Filesize
8KB
-
Filesize
152KB
-
Filesize
180KB