Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
24/01/2023, 15:43
General
- Target 007eb737493994bd0ff1aaac4af0b84a.exe
- Size 4.8MB
- Sample230124-s511laea4t
- SHA256 45982d6a7674a3ff4d2f28e95963d74729e0cb3059c08ef2e4c235182bf4591d
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\007eb737493994bd0ff1aaac4af0b84a.exe"C:\Users\Admin\AppData\Local\Temp\007eb737493994bd0ff1aaac4af0b84a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Update.exeC:\Users\Admin\AppData\Local\Temp\Update.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ħ¾§.exeC:\Users\Admin\AppData\Local\Temp\ħ¾§.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
Update.exe
Update.exe
ħ¾§.exe
ħ¾§.exe
memory/4612-147-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-176-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-145-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-149-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-132-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-151-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-153-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-155-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-157-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-159-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-162-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-164-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-166-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-168-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-170-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-172-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-174-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-143-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-178-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-141-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-139-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-136-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-182-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-134-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-137-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4612-135-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-190-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-191-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-193-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-195-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-199-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-201-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-203-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-197-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4888-233-0x0000000010000000-0x000000001003E000-memory.dmp