eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
131s
max time network
184s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09/05/2023, 19:14 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trojan-leaks-main/skidded/Unis.exe
Size

892KB
MD5

e72088233e9d7d1d9826a35604c49fd7
SHA1

fa8a5990e2e1b7fb8e23af3ae54be58fce2125c2
SHA256

d2e3b68594ba8a21eb03056554dcc6ed43030e6e2969caef6f205fe86390339c
SHA512

3fdf6da405782b8ab3105ae088b85f0616df27fb58042bc9e4adc458017e345e8bb4199ccc1b4682f8471bc463c888ff658513bb25ed0f1cc6027c0606cf69b5
SSDEEP

12288:GoSWNTlKOtLP3gagtWFvD34Isq0hZsEZy35LDSbtn6tfJtvDyG4G99:GoS2TlhtKidsd+EZV6NJdUA9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 996	4112	Unis.exe	68
PID 4112 wrote to memory of 996	4112	Unis.exe	68

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Unis.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Unis.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F9F5.tmp\F9F6.tmp\F9F7.bat C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\skidded\Unis.exe"
  2⤵
  PID:996

Network

DNS

1.77.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.77.109.52.in-addr.arpa

IN PTR

Response

20.189.173.10:443

322 B
7

8.8.8.8:53

1.77.109.52.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

1.77.109.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F9F5.tmp\F9F6.tmp\F9F7.bat

Filesize
714B

MD5
c645904efc201e9cc2660d251a08f3cb

SHA1
6d35f7f5f7012710b228a280e2a49eff98e4adcd

SHA256
4e254ec30432a08d7a2a11ed188bd017fd555bd998c7233c1f444541fac5001b

SHA512
053f781df0403561cf5889aa7d0688f5ab13a2005524aa4ac2be911c0a7597544763c726d9e40e894773bcc73e37f11113576fa2567d05e83ff64790e423ef73

Download Submit

Resubmissions

Analysis