035a192cecb0d2aeb8050a4a8ebf8215a43cbf20191dcc603cb1019d202b528b | Triage

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 11:51

Sharing

Report Analysis Logs

General

Target

p3wrapper.exe
Size

3.4MB
MD5

508fa2d8bcc11dd1a6b1c89a9f299e1c
SHA1

1eb736005acd3a4e6584386adf482aff396a16f4
SHA256

c0ad03bd5865773c2dec0d4c243af995257c394ec4560bba6810744c6ccd4b3f
SHA512

cf7653adec51591be84dd38499d36dc4b3c31f70cc779f6eb789c1490cd1a27562060f3a8e6cfc51fd39e79406a37aa4b3d016d20d367330cc83b6ec92425361
SSDEEP

98304:MBmtZMBqxuXQ/3hM5cRXH1e+Ni8QDiZ/8PS7KAtJyjHTp1:6m44gXWj1HCjWaaLJyp1

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral4/memory/4440-132-0x0000000000150000-0x000000000083C000-memory.dmp	upx
behavioral4/memory/4440-133-0x0000000000150000-0x000000000083C000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

p3wrapper.exe

description ioc process

File created C:\Windows\Net Helper\p3.exe p3wrapper.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 5 Go-http-client/1.1

C:\Users\Admin\AppData\Local\Temp\p3wrapper.exe
"C:\Users\Admin\AppData\Local\Temp\p3wrapper.exe"
1⤵
- Drops file in Windows directory
PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4440-132-0x0000000000150000-0x000000000083C000-memory.dmp

Filesize
6.9MB

Download
memory/4440-133-0x0000000000150000-0x000000000083C000-memory.dmp

Filesize
6.9MB

Download