Analysis
-
max time kernel
257s -
max time network
339s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01-12-2022 20:35
General
-
Target
9b5a910c4cc78d92249f2e6b5d3b7273013da77a46b8e66d001370e0d6b72ad3.exe
-
Size
372KB
-
MD5
e7aa39a72a30fa7e050a3b1eda9d0673
-
SHA1
0b3c8a03c5583f537cf7efa98786eb0abf6a15e4
-
SHA256
9b5a910c4cc78d92249f2e6b5d3b7273013da77a46b8e66d001370e0d6b72ad3
-
SHA512
10c1f2478dcd98c55ee1cf0ba833d9b67113c5120b6e8d30da776d804b2d77d79ef632f538f88a3bd90e08ca72e51e979c305b8e21285d7d0823a84793f5c49e
-
SSDEEP
6144:jvCYy9p/Ra60sL61FXAV6QaysoxnBeuv0NnYTLSsC20ehOghQWDBXmkMbo3t:jvcR6f1NAVPaOvIYHSsRvOO3DskMk3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b5a910c4cc78d92249f2e6b5d3b7273013da77a46b8e66d001370e0d6b72ad3.exe"C:\Users\Admin\AppData\Local\Temp\9b5a910c4cc78d92249f2e6b5d3b7273013da77a46b8e66d001370e0d6b72ad3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nL01605FdFdB01605\nL01605FdFdB01605.exe"C:\ProgramData\nL01605FdFdB01605\nL01605FdFdB01605.exe" "C:\Users\Admin\AppData\Local\Temp\9b5a910c4cc78d92249f2e6b5d3b7273013da77a46b8e66d001370e0d6b72ad3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
MD506e3a0c65a98731c5e505823dfc80774
SHA1db0d4c08f7bea6811ba9321e0ac91b14f56f5b79
SHA2567fab4ec9a84457622fbfa45528d028e9d63008df38bf2543e6527708fa1f6f7c
SHA512500c308d9b99b3ce2c86c8ca3aeca8d82d14e9069217397e37d201d6256dfce8e8320ed7df33cea96dcf1c3555fef4ed13d83b93cbd3e09267aea2b3f7e22261
-
Filesize
372KB
MD506e3a0c65a98731c5e505823dfc80774
SHA1db0d4c08f7bea6811ba9321e0ac91b14f56f5b79
SHA2567fab4ec9a84457622fbfa45528d028e9d63008df38bf2543e6527708fa1f6f7c
SHA512500c308d9b99b3ce2c86c8ca3aeca8d82d14e9069217397e37d201d6256dfce8e8320ed7df33cea96dcf1c3555fef4ed13d83b93cbd3e09267aea2b3f7e22261
-
Filesize
372KB
MD506e3a0c65a98731c5e505823dfc80774
SHA1db0d4c08f7bea6811ba9321e0ac91b14f56f5b79
SHA2567fab4ec9a84457622fbfa45528d028e9d63008df38bf2543e6527708fa1f6f7c
SHA512500c308d9b99b3ce2c86c8ca3aeca8d82d14e9069217397e37d201d6256dfce8e8320ed7df33cea96dcf1c3555fef4ed13d83b93cbd3e09267aea2b3f7e22261
-
Filesize
372KB
MD506e3a0c65a98731c5e505823dfc80774
SHA1db0d4c08f7bea6811ba9321e0ac91b14f56f5b79
SHA2567fab4ec9a84457622fbfa45528d028e9d63008df38bf2543e6527708fa1f6f7c
SHA512500c308d9b99b3ce2c86c8ca3aeca8d82d14e9069217397e37d201d6256dfce8e8320ed7df33cea96dcf1c3555fef4ed13d83b93cbd3e09267aea2b3f7e22261
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
780KB
-
-
Filesize
780KB
-
Filesize
780KB