14a3894cd6a6e321d3a07c5b7a2bd22cad174f55feef3b6b6e2279fc5ea66ee8 | Triage

Analysis

max time kernel
149s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:48

Sharing

Report Analysis Logs

General

Target

远程监控/hbf72.exe
Size

3.6MB
MD5

c07eb32fbd1ab2b529d062f3ee296bda
SHA1

cdfea71939c7a7a61f8522ff8f6601a8b008eeb0
SHA256

58b3cfbdec632419682a288e6c035e9e5d6329d0b759d6882df712b9236d0ae8
SHA512

ca42a3ca881a59e558bcec5a92ef294115fc23a99518d51869462e6a7bd55baa3be6ebeeb00ce1460201a0e06eca1d2e737db023c5d0ec0b76df8880f9a9bc08
SSDEEP

98304:LNfwcXZ3c8XaGEbJpk6elrO47rzgyS7qEM0jHL8AQYpGBhRjB:6qppETNSrOE1iqqjHL86QBhX

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral16/memory/4524-132-0x0000000000400000-0x0000000000708000-memory.dmp	upx
behavioral16/memory/4524-133-0x0000000000400000-0x0000000000708000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\远程监控\hbf72.exe
"C:\Users\Admin\AppData\Local\Temp\远程监控\hbf72.exe"
1⤵
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4524-132-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download
memory/4524-133-0x0000000000400000-0x0000000000708000-memory.dmp

Filesize
3.0MB

Download