d494e9b4970d2d6792a117d6cc908d8424fe1e69c21a8075465ba431faa9c651 | Triage

Analysis

max time kernel
150s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 10:53

Sharing

Report Analysis Logs

General

Target

x1nject.exe
Size

262KB
MD5

e974a7ed7fa0c096aa1f59ae6d8cce72
SHA1

24b215e712fa745ac94d033ee7c5a556a5df0dab
SHA256

d042a6add7b1547e5165d0c0c0f0eb21ee778b44c27e0a2bbce9f02b79156c0b
SHA512

156cfa7b252d8737a4d3fdc3f8095353051d7f15e1293d6c1213de36ea44d526fd94e75765b3a1f75ed83f9b02dd4329b9eab466e9188fea107e622d0c1d6ba4
SSDEEP

6144:jYPOodm30xwcP9n2U82xZkckexoS8pm97WQP:Ydm3xc4L24cVoS8c97Wy

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral3/memory/1264-55-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

x1nject.exe

pid	process
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe
1264	x1nject.exe

C:\Users\Admin\AppData\Local\Temp\x1nject.exe
"C:\Users\Admin\AppData\Local\Temp\x1nject.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1264-55-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download