Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11/10/2022, 04:39
General
-
Target
8fdf09839d24d022c07824057ba5ca4430c9c728decb31a6b83ba395ba38396c.exe
-
Size
412KB
-
MD5
2e34a936de1f285b71403cff1118ebf8
-
SHA1
395e40c8fb0b304deb5c62f0a412f972047ef9e3
-
SHA256
8fdf09839d24d022c07824057ba5ca4430c9c728decb31a6b83ba395ba38396c
-
SHA512
7353e6f7dd10c9f9e35d338d47d0c28d12668a23a45bfaeade43a87eba1cc0058107b2bcf1e95d5316231723ca93668148a32e19b98e0f8bd5eea254cd64614d
-
SSDEEP
6144:C1IrQ+K8JMLl0We88qdbZsmLEsq1gMMkcz410GoK2ZIlfkqbtx4JM7cC:C1IrQ+K8JWzXbJucWgDHzi0VZMfLb/I
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fdf09839d24d022c07824057ba5ca4430c9c728decb31a6b83ba395ba38396c.exe"C:\Users\Admin\AppData\Local\Temp\8fdf09839d24d022c07824057ba5ca4430c9c728decb31a6b83ba395ba38396c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\gE12402OcLkK12402\gE12402OcLkK12402.exe"C:\ProgramData\gE12402OcLkK12402\gE12402OcLkK12402.exe" "C:\Users\Admin\AppData\Local\Temp\8fdf09839d24d022c07824057ba5ca4430c9c728decb31a6b83ba395ba38396c.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD518341c57158b71a4b4baaf6936e6090f
SHA1dec10134f73e5caa56caac7b6dfa15caaebfa874
SHA2562644c5dc138dd762747bb0d9573de980d7565c775c5d8ee3237927a59f59f2ec
SHA51218825f998a7d477b55bd032349f946094b07220c7776240c9bcc2821527e769936c01d88d1d2a458c85f6db402ce85926a23fcdb531cf67bafd037db14df712b
-
Filesize
412KB
MD518341c57158b71a4b4baaf6936e6090f
SHA1dec10134f73e5caa56caac7b6dfa15caaebfa874
SHA2562644c5dc138dd762747bb0d9573de980d7565c775c5d8ee3237927a59f59f2ec
SHA51218825f998a7d477b55bd032349f946094b07220c7776240c9bcc2821527e769936c01d88d1d2a458c85f6db402ce85926a23fcdb531cf67bafd037db14df712b
-
Filesize
412KB
MD518341c57158b71a4b4baaf6936e6090f
SHA1dec10134f73e5caa56caac7b6dfa15caaebfa874
SHA2562644c5dc138dd762747bb0d9573de980d7565c775c5d8ee3237927a59f59f2ec
SHA51218825f998a7d477b55bd032349f946094b07220c7776240c9bcc2821527e769936c01d88d1d2a458c85f6db402ce85926a23fcdb531cf67bafd037db14df712b
-
Filesize
412KB
MD518341c57158b71a4b4baaf6936e6090f
SHA1dec10134f73e5caa56caac7b6dfa15caaebfa874
SHA2562644c5dc138dd762747bb0d9573de980d7565c775c5d8ee3237927a59f59f2ec
SHA51218825f998a7d477b55bd032349f946094b07220c7776240c9bcc2821527e769936c01d88d1d2a458c85f6db402ce85926a23fcdb531cf67bafd037db14df712b
-
Filesize
860KB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
860KB
-
Filesize
860KB