Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05/12/2022, 06:56
General
-
Target
c0e415b1d15ac0b514be803c1e43c85dc650124a05d7ccc463cc9dd475c7c80c.exe
-
Size
224KB
-
MD5
903a2aeada691ec02f533e4e1b2b120a
-
SHA1
50babdd09a4b1ed077ca532a4bda641ae5b9d3b8
-
SHA256
c0e415b1d15ac0b514be803c1e43c85dc650124a05d7ccc463cc9dd475c7c80c
-
SHA512
2cb8772599afe3a82f23c5c4fa741511c1153a80dd8efeeef88c0b6de3006e9a0b444aa76dbd57060c5c638817911ba5576ee43e14a6ceb535ba1f4816fbac44
-
SSDEEP
6144:sriIXJz6FHoOrVXl7HWrE+icB8aa36OCwb7eEk8vEE+M1e9:XIZzmjXVHGbKaW60b7eX8vE
Malware Config
Signatures
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0e415b1d15ac0b514be803c1e43c85dc650124a05d7ccc463cc9dd475c7c80c.exe"C:\Users\Admin\AppData\Local\Temp\c0e415b1d15ac0b514be803c1e43c85dc650124a05d7ccc463cc9dd475c7c80c.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
724B
MD5b5413494bca58f576f989746a450ed41
SHA1e1829e329725768802a545ff91e4723219f0e039
SHA2563b5f859e39a5ee38aeaf1092abfae4a2c994f06ab6d15968fdba141fbf3cb3ee
SHA512a10d762d064be23f3d1d44945380c23456355adbb01bb54dfeba87963c24a71af81661481632b953d6d905b7cf57063136460715b2cf961e4c8f7097239ab592
-
Filesize
224KB
MD57e84e98a76b80ff951166059f976e62a
SHA16335f7a855f218561530fded8f7f8cef2b4ab9b1
SHA256aea27ffd55fe32089c2d88d98d21d784831c341f7eda79bf628575029e2b5415
SHA512057708f5b7a99d73b40771f7adb3b6fd873cd47ba4eb13d10b5907d2464432a54cb7f70525b055cba2568318cebf073ea08c1e162334dff7d5a995d0ce8823d1
-
Filesize
224KB
MD57e84e98a76b80ff951166059f976e62a
SHA16335f7a855f218561530fded8f7f8cef2b4ab9b1
SHA256aea27ffd55fe32089c2d88d98d21d784831c341f7eda79bf628575029e2b5415
SHA512057708f5b7a99d73b40771f7adb3b6fd873cd47ba4eb13d10b5907d2464432a54cb7f70525b055cba2568318cebf073ea08c1e162334dff7d5a995d0ce8823d1
-
Filesize
224KB
MD57e84e98a76b80ff951166059f976e62a
SHA16335f7a855f218561530fded8f7f8cef2b4ab9b1
SHA256aea27ffd55fe32089c2d88d98d21d784831c341f7eda79bf628575029e2b5415
SHA512057708f5b7a99d73b40771f7adb3b6fd873cd47ba4eb13d10b5907d2464432a54cb7f70525b055cba2568318cebf073ea08c1e162334dff7d5a995d0ce8823d1
-
Filesize
8KB
-
Filesize
64.0MB
-
Filesize
384KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
384KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB