Overview

overview

8

Static

static

8

comprovant...xo.exe

windows7-x64

8

comprovant...xo.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    42s
  • max time network
    67s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 19:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    comprovante_pagamento_Anexo.exe

  • Size

    1.8MB

  • MD5

    e8846d41953cb068bc5ed2b0e2cba62f

  • SHA1

    16620934e35832dd2a2b45a83e6ef33e70b6dc33

  • SHA256

    e6378892713c1caa7b346891f2fb04e01de5e061476228f463e0932995584c57

  • SHA512

    a5e2cff3d93085dc7c10106d69e25723992921a5b8ceb57af5f0a1d7b5245f073079eb0d4abbbec84c3625c9668003076fca02b7069698450b9caf4e3a4c8c89

  • SSDEEP

    49152:3n0nwnGlgvBD/DExH7G9AWiA5bY0yF2FXzf2H:3n0sCgvBD/eG9AWHYDoFXzf2H

Score
8/10
persistenceupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\comprovante_pagamento_Anexo.exe
    "C:\Users\Admin\AppData\Local\Temp\comprovante_pagamento_Anexo.exe"
    1⤵
    • Adds Run key to start application
    PID:812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/812-54-0x0000000000400000-0x0000000000825000-memory.dmp
    Filesize

    4.1MB

    Download
  • memory/812-55-0x0000000000400000-0x0000000000825000-memory.dmp
    Filesize

    4.1MB

    Download