Analysis
-
max time kernel
91s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28-10-2022 20:00
General
-
Target
5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe
-
Size
256KB
-
MD5
0c071a67c99e505b573db30387c2ace7
-
SHA1
353e0312e7c7b28910e5a00740cf26498b15453b
-
SHA256
5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3
-
SHA512
c7df245acc8cb143609c8c6f3e5283d58f59bd3b00fab84c42a2e8672334f46f7a6ec7a3d2303f85175a6a8ecd75aa107f257b0d0c6b772be8445736b8c559f3
-
SSDEEP
6144:bvvuchulnYvSOEt5zpaiRhcuGE07v6a8:bXU+wNxRhTKj6
Malware Config
Signatures
-
ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe"C:\Users\Admin\AppData\Local\Temp\5a409013988f033e050024d87e32038e4b036295799415d240903e3d0a127fc3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\292e5526.exeC:\292e5526.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5d31be269eff784b082fc8816b4847499
SHA10b8c8f99352dddb2548486cc3c6eb5a068bfad3b
SHA2569e5b6218c75a22c897687c7872f1b35825411e3a4e05e56650966e8999014047
SHA512e847065b7405588c364e004a993b80d0a5cca763393a49535869bc910623134c4d96eb0d9dad85b24b9da6f1fbea0d246cf7feec5b1433ed2c130e4f7252b3af
-
Filesize
223KB
MD5d31be269eff784b082fc8816b4847499
SHA10b8c8f99352dddb2548486cc3c6eb5a068bfad3b
SHA2569e5b6218c75a22c897687c7872f1b35825411e3a4e05e56650966e8999014047
SHA512e847065b7405588c364e004a993b80d0a5cca763393a49535869bc910623134c4d96eb0d9dad85b24b9da6f1fbea0d246cf7feec5b1433ed2c130e4f7252b3af
-
Filesize
724B
MD5a1df1d2126318e4ea2857d8cf15473f5
SHA15c1dca74c80169e0a4b479fa5ba4a02310ac8a03
SHA256328269ab29094ae843eb3fba24fe983d30410caf4555fde64c28dec432d430db
SHA512f634509ae4cf0191229bbd16a7db67ff87444bb7e3f9ca4451792fe28f1e20e6754a34c29461a44cc322ed1a9d54421616364762ed753867cdd91cd005204d09
-
Filesize
223KB
MD5d8c4b2d029ca0e6c77f248a11cba01da
SHA135c35b7e1c4e34328212dccf83aaee87cb36d050
SHA256d8e7ac66844762b17c7d57e663b4b9044347ede197f2492e90f4b6d0d3f19c37
SHA5120266c507c64a2c7603bf7897eab543cac6aae6fc028d1fb29afac6ac3f27697f21612680b888a4c97837c8272d30fb8c3cccef89826648eaf9bd38cd956f3285
-
Filesize
223KB
MD5d8c4b2d029ca0e6c77f248a11cba01da
SHA135c35b7e1c4e34328212dccf83aaee87cb36d050
SHA256d8e7ac66844762b17c7d57e663b4b9044347ede197f2492e90f4b6d0d3f19c37
SHA5120266c507c64a2c7603bf7897eab543cac6aae6fc028d1fb29afac6ac3f27697f21612680b888a4c97837c8272d30fb8c3cccef89826648eaf9bd38cd956f3285
-
Filesize
256KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
64.0MB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB