Analysis
-
max time kernel
135s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
04/12/2022, 09:54
General
-
Target
ccf99636ab1165fb63e9e16d6b6579522c9adcea2fad716f11cd4dc8f2143282.exe
-
Size
44KB
-
MD5
eabaefb4af7925fd06a68daebc4663c3
-
SHA1
fde4185564d248779a4255bf0805b3afb18b9651
-
SHA256
ccf99636ab1165fb63e9e16d6b6579522c9adcea2fad716f11cd4dc8f2143282
-
SHA512
1174a23b9dd492f50a1651b6d585a962003d79c97a1a3b55dddf138052037a94fcd4bcb0c3171524ef72bb563f2fb633efa47879f4e4041b588db6e29ef1bc70
-
SSDEEP
768:b/GuBtIDBRunv+A3tig2VuMN5+CwqwkWKQJCk1ovxkLlqfqi:b//MRI2zVuMN5ixktQXSMlli
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccf99636ab1165fb63e9e16d6b6579522c9adcea2fad716f11cd4dc8f2143282.exe"C:\Users\Admin\AppData\Local\Temp\ccf99636ab1165fb63e9e16d6b6579522c9adcea2fad716f11cd4dc8f2143282.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sysroc.exeC:\Windows\system32\sysroc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5eabaefb4af7925fd06a68daebc4663c3
SHA1fde4185564d248779a4255bf0805b3afb18b9651
SHA256ccf99636ab1165fb63e9e16d6b6579522c9adcea2fad716f11cd4dc8f2143282
SHA5121174a23b9dd492f50a1651b6d585a962003d79c97a1a3b55dddf138052037a94fcd4bcb0c3171524ef72bb563f2fb633efa47879f4e4041b588db6e29ef1bc70
-
Filesize
44KB
MD5eabaefb4af7925fd06a68daebc4663c3
SHA1fde4185564d248779a4255bf0805b3afb18b9651
SHA256ccf99636ab1165fb63e9e16d6b6579522c9adcea2fad716f11cd4dc8f2143282
SHA5121174a23b9dd492f50a1651b6d585a962003d79c97a1a3b55dddf138052037a94fcd4bcb0c3171524ef72bb563f2fb633efa47879f4e4041b588db6e29ef1bc70
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB