Overview

overview

8

Static

static

a0b0d6c405...0a.exe

windows7-x64

8

a0b0d6c405...0a.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/11/2022, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a0b0d6c405742d572c4b0d019b441bad4a2076c4a7e7ab0a1a8abcd7b887b30a.exe

  • Size

    459KB

  • MD5

    525c40c0f8e98c800a5f7a9f062ed3f2

  • SHA1

    bd1fe4af64a8e5d3437a54b4dbddfac2c7e6fbb4

  • SHA256

    a0b0d6c405742d572c4b0d019b441bad4a2076c4a7e7ab0a1a8abcd7b887b30a

  • SHA512

    f7333d56a5eee4b9c0ce9108ada2f9114e00d894aca36477139c8857857a1ac5967c833f263c2fb26f797af7b09edd076b35c1843dc91a66909f3746f80c47e2

  • SSDEEP

    12288:doUc4ZG/+y1C9Ob7kQgT9EjjZKdS9ZArbTJrKYn:don4loJb7k/TogdS9Z4nJu

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0b0d6c405742d572c4b0d019b441bad4a2076c4a7e7ab0a1a8abcd7b887b30a.exe
    "C:\Users\Admin\AppData\Local\Temp\a0b0d6c405742d572c4b0d019b441bad4a2076c4a7e7ab0a1a8abcd7b887b30a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\ProgramData\mK28258IaCmG28258\mK28258IaCmG28258.exe
      "C:\ProgramData\mK28258IaCmG28258\mK28258IaCmG28258.exe" "C:\Users\Admin\AppData\Local\Temp\a0b0d6c405742d572c4b0d019b441bad4a2076c4a7e7ab0a1a8abcd7b887b30a.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1368

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\mK28258IaCmG28258\mK28258IaCmG28258.exe
          Filesize

          459KB

          MD5

          bbe80e59dc764026d679431d0941ee7c

          SHA1

          464a3b8cf115f4d080bef442c831898f9f8c66bc

          SHA256

          f81856b7720e41e926730ac7b2815eb53bbed7e799907067539f7db68d1abf07

          SHA512

          a0f9bde4042a060a755122d82a040d754260ef8d6b2f3c52c12b6761f014220747a184017713871879740f1af0e90be3fc26a411fa40aa2351daf2a8973085b3

          Download Submit

        • C:\ProgramData\mK28258IaCmG28258\mK28258IaCmG28258.exe
          Filesize

          459KB

          MD5

          bbe80e59dc764026d679431d0941ee7c

          SHA1

          464a3b8cf115f4d080bef442c831898f9f8c66bc

          SHA256

          f81856b7720e41e926730ac7b2815eb53bbed7e799907067539f7db68d1abf07

          SHA512

          a0f9bde4042a060a755122d82a040d754260ef8d6b2f3c52c12b6761f014220747a184017713871879740f1af0e90be3fc26a411fa40aa2351daf2a8973085b3

          Download Submit

        • memory/1368-138-0x0000000000400000-0x00000000004C1000-memory.dmp

          Filesize

          772KB

          Download

        • memory/1368-139-0x0000000000761000-0x00000000007B1000-memory.dmp

          Filesize

          320KB

          Download

        • memory/1368-140-0x0000000000400000-0x00000000004C1000-memory.dmp

          Filesize

          772KB

          Download

        • memory/4104-132-0x0000000000400000-0x00000000004C1000-memory.dmp

          Filesize

          772KB

          Download

        • memory/4104-133-0x0000000000861000-0x00000000008B1000-memory.dmp

          Filesize

          320KB

          Download

        • memory/4104-137-0x0000000000400000-0x00000000004C1000-memory.dmp

          Filesize

          772KB

          Download