Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07-12-2022 01:43
General
-
Target
e9d9f569c3db831b88fe66894939928eebf89cf9080ab341bba68e8d09410c9c.exe
-
Size
27KB
-
MD5
4a9a741d64dc6011d4a00e182c16a935
-
SHA1
7259659b5cb4cb207bd6104fd08bcf5a5f569a75
-
SHA256
e9d9f569c3db831b88fe66894939928eebf89cf9080ab341bba68e8d09410c9c
-
SHA512
97112090f56d09a9fec5337fc4e12e8d62573ccdb3a4dd43faa3b12e373ab5511f06e5d65e29c03e50425871e45704820a85053db8404a0e3a0b66e7634b4e5a
-
SSDEEP
384:7XvGY+rTTGyTBOu2Bg5Xt0ArZZLOHFfTdAnOg7qveQJ4+twCuu+nNYJLPGBq:7fGvv9QuRyAr7mFfp6CWQJz+n4Lgq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9d9f569c3db831b88fe66894939928eebf89cf9080ab341bba68e8d09410c9c.exe"C:\Users\Admin\AppData\Local\Temp\e9d9f569c3db831b88fe66894939928eebf89cf9080ab341bba68e8d09410c9c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~6c5132.tmpC:\Users\Admin\AppData\Local\Temp\~6c5132.tmp2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5bf570d55a8a787fd36668c087ef9bc2b
SHA1fc0f2d5a31c99e981be903aac75a71e19b7bc1fa
SHA2569b20fe9d403a524296e1c47870a2d77ec322b601f5ef42645bf514bf0c4bfe73
SHA512b8bc2ec85c11a7d225ff4723e608e5ea27e0b7431cd2834c875b3c8160a0798b35306f7d9a32c1fca32eaeaffa57c7ba9e8a1158298962503b7778b35203db68
-
Filesize
6KB
MD5bf570d55a8a787fd36668c087ef9bc2b
SHA1fc0f2d5a31c99e981be903aac75a71e19b7bc1fa
SHA2569b20fe9d403a524296e1c47870a2d77ec322b601f5ef42645bf514bf0c4bfe73
SHA512b8bc2ec85c11a7d225ff4723e608e5ea27e0b7431cd2834c875b3c8160a0798b35306f7d9a32c1fca32eaeaffa57c7ba9e8a1158298962503b7778b35203db68
-
Filesize
6KB
MD5bf570d55a8a787fd36668c087ef9bc2b
SHA1fc0f2d5a31c99e981be903aac75a71e19b7bc1fa
SHA2569b20fe9d403a524296e1c47870a2d77ec322b601f5ef42645bf514bf0c4bfe73
SHA512b8bc2ec85c11a7d225ff4723e608e5ea27e0b7431cd2834c875b3c8160a0798b35306f7d9a32c1fca32eaeaffa57c7ba9e8a1158298962503b7778b35203db68
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
56KB
-