Analysis

  • max time kernel
    90s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-12-2022 12:46

General

  • Target

    d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe

  • Size

    1.1MB

  • MD5

    5262550e302e933e10c9eeedddcd5fd2

  • SHA1

    50a11f78f6698422d18f3c218627680b4204c857

  • SHA256

    d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6

  • SHA512

    9ae9b1ece589b414c605b2ed0f6d61a5c24cebd376171341c841c81c44b01cd18069bf98b6347ffb0a188ad5e09c542c09f06ef54ff95a3f7c1fd83697748c00

  • SSDEEP

    24576:zh9bn+rEWHL+QY6/9oICxHJ1fyYJizI7lv7ke77uwo0jziG:zh9LHjk9WhryYD7x4Zz4mG

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe
    "C:\Users\Admin\AppData\Local\Temp\d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\E_N4\WebBrowser2.fne

    Filesize

    256KB

    MD5

    f34c58153766a46f29726f18ea61de84

    SHA1

    74a10a94d3713f2959271d3e759340b8b09b2903

    SHA256

    6b0886e69b7543cd96569e259e97f501048c3c86ab8d168f1884d7f630cbfedb

    SHA512

    64ea97a0b941d62fdb19f6a6eef4abbedf818525b920e09b0dad329344b96221a4452262dad4f48d89a5851d507df230a3c0cd49b211da0ea253b70ab968c8a0

  • C:\Users\Admin\AppData\Local\Temp\E_N4\WebBrowser2.fne

    Filesize

    256KB

    MD5

    f34c58153766a46f29726f18ea61de84

    SHA1

    74a10a94d3713f2959271d3e759340b8b09b2903

    SHA256

    6b0886e69b7543cd96569e259e97f501048c3c86ab8d168f1884d7f630cbfedb

    SHA512

    64ea97a0b941d62fdb19f6a6eef4abbedf818525b920e09b0dad329344b96221a4452262dad4f48d89a5851d507df230a3c0cd49b211da0ea253b70ab968c8a0

  • C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

    Filesize

    216KB

    MD5

    cba933625bfa502fc4a1d9f34e1e4473

    SHA1

    5319194388c0e53321f99f1541b97af191999a09

    SHA256

    25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

    SHA512

    f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

  • C:\Users\Admin\AppData\Local\Temp\E_N4\iext.fnr

    Filesize

    216KB

    MD5

    cba933625bfa502fc4a1d9f34e1e4473

    SHA1

    5319194388c0e53321f99f1541b97af191999a09

    SHA256

    25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013

    SHA512

    f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142

  • C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

    Filesize

    1.1MB

    MD5

    638e737b2293cf7b1f14c0b4fb1f3289

    SHA1

    f8e2223348433b992a8c42c4a7a9fb4b5c1158bc

    SHA256

    baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b

    SHA512

    4d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12

  • memory/1556-163-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-165-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-141-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-143-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-145-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-147-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-149-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-151-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-153-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-155-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-157-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-159-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-161-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-138-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-167-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-139-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-169-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-171-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-173-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-175-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-177-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-179-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-182-0x0000000002530000-0x0000000002574000-memory.dmp

    Filesize

    272KB

  • memory/1556-137-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-136-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-184-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-134-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB

  • memory/1556-187-0x0000000002810000-0x0000000002854000-memory.dmp

    Filesize

    272KB

  • memory/1556-133-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/1556-189-0x0000000000400000-0x0000000000469000-memory.dmp

    Filesize

    420KB

  • memory/1556-190-0x0000000002300000-0x000000000233E000-memory.dmp

    Filesize

    248KB