Analysis

  • max time kernel
    161s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 11:08

General

  • Target

    be1e5d62157b393d3af5e9ccad19cfce4548c41cbc3acfbb5747136ed6420b9b.exe

  • Size

    56KB

  • MD5

    10d602a94df9fb799a28e0b521c996b6

  • SHA1

    371eb9a9aa394c39320703de88f824a73fb53a7b

  • SHA256

    be1e5d62157b393d3af5e9ccad19cfce4548c41cbc3acfbb5747136ed6420b9b

  • SHA512

    fd75d762545e7c3f65dd0a72a70019fe7decd16d8fb1c4a6cd64d0497d3d325ba3d17e1b2a78e241f8f05e54111c9125e8d39aaab84320dab8cd2b42ecca46d9

  • SSDEEP

    768:pUDovscJiOxDb6Dmze7i4Hp/XUKG5kv6suq48DBIquMEx0OCJv49Ue9YAymAqQ10:pao1JfF+hZCrivr2TIJvGUeWDvqQK

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:724
      • C:\Users\Admin\AppData\Local\Temp\be1e5d62157b393d3af5e9ccad19cfce4548c41cbc3acfbb5747136ed6420b9b.exe
        "C:\Users\Admin\AppData\Local\Temp\be1e5d62157b393d3af5e9ccad19cfce4548c41cbc3acfbb5747136ed6420b9b.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2336

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D.exe

            Filesize

            31KB

            MD5

            23e9f007ff410b3c40c6e60a9ae871e2

            SHA1

            355deceaa31e93289255621878705086546096fe

            SHA256

            12af6eb089a2f56c5104ebc168897fdc0b6cce22f8ea473e7298b9542c40a7c9

            SHA512

            02946b31ee17de418949aa19590fb55d494c99c25b5d66fde8f5a82618dc5b1e10ca56bfdc99a8e6f68a31b80de0d5da57a3d77e531b36c837254b3d06f153b5

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\D.exe

            Filesize

            31KB

            MD5

            23e9f007ff410b3c40c6e60a9ae871e2

            SHA1

            355deceaa31e93289255621878705086546096fe

            SHA256

            12af6eb089a2f56c5104ebc168897fdc0b6cce22f8ea473e7298b9542c40a7c9

            SHA512

            02946b31ee17de418949aa19590fb55d494c99c25b5d66fde8f5a82618dc5b1e10ca56bfdc99a8e6f68a31b80de0d5da57a3d77e531b36c837254b3d06f153b5

          • memory/724-137-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

            Filesize

            28KB

          • memory/2252-132-0x0000000001000000-0x0000000001018000-memory.dmp

            Filesize

            96KB

          • memory/2252-139-0x0000000001000000-0x0000000001018000-memory.dmp

            Filesize

            96KB

          • memory/2336-136-0x0000000000400000-0x0000000000408960-memory.dmp

            Filesize

            34KB

          • memory/2336-138-0x0000000010000000-0x0000000010013000-memory.dmp

            Filesize

            76KB