Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2023, 01:10

General

  • Target

    8cdcea683ae0eac3a3e2013cbdfc877ec55af6dd0a6b038f82b70d86c20fb21a.exe

  • Size

    11.8MB

  • MD5

    7e2f11fd9c74a960c7a98a7680258cde

  • SHA1

    855513f6bef507e08dc7491977023a5a77948790

  • SHA256

    8cdcea683ae0eac3a3e2013cbdfc877ec55af6dd0a6b038f82b70d86c20fb21a

  • SHA512

    501a1ce9cb7dffe5a16d1b9633bd3d8162842893330dbe93ce3a03e1287715220be2aaad0e3ea92827f00257e6208f6c181cbab4a88164aa744021d4acdaf5a4

  • SSDEEP

    196608:NPg/Q6bpH5hUrZ+qfqTVv6QCPuEwrZT7nd4U/OpSy4DU1NzCqEH+jXDCP9BqnLnW:qJ5heZ0VvzCPMr17nXySTDqEHqWn+L7S

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cdcea683ae0eac3a3e2013cbdfc877ec55af6dd0a6b038f82b70d86c20fb21a.exe
    "C:\Users\Admin\AppData\Local\Temp\8cdcea683ae0eac3a3e2013cbdfc877ec55af6dd0a6b038f82b70d86c20fb21a.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8cdcea683ae0eac3a3e2013cbdfc877ec55af6dd0a6b038f82b70d86c20fb21a.exepack.tmp

    Filesize

    2KB

    MD5

    fab4097857f332ebde7e41db42372728

    SHA1

    80d890007af708c7e9fdf5050a4c48b121cdd57b

    SHA256

    cac40ab0d032f4ef85c9fa958ea975313f7d37f3bbec71114bb9816a5e67a7c1

    SHA512

    32170e2ede006fc80d13ef7a0b2c64f4ae2c6a1880b3a0514dc21b177143f048592e02f67c96a628c65e25a3f3d8ee85c0156a078370201a3b667e30ed28a286

  • C:\Users\Admin\AppData\Local\Temp\af2b0e0f3a50df69a3d204f5d40729d1.ini

    Filesize

    1KB

    MD5

    242a7e0f0825888bb93ef3b9cc71e464

    SHA1

    6899db54d6871213b6417858c178a5732b0c7107

    SHA256

    a891b6f795307c6eeecd451c5d48721d8f96feb447451c39f9078771e1ca224a

    SHA512

    54d20efe82e52467b1bf35d17231b82c23070ff0d440f7668f4dcbf951107b3943ee9cb59dc69bab63c43ff8f765db569819c87341285a7948a45518e896313b

  • C:\Users\Admin\AppData\Local\Temp\af2b0e0f3a50df69a3d204f5d40729d1A.ini

    Filesize

    1KB

    MD5

    95dd0638c155dc69000b9b595f5b202a

    SHA1

    4fe93f7861973441a6e5e6741f95ffedb2ec6364

    SHA256

    2048ad3a32a0c9d5bcfab1b0098ddf0a17bd8611253b436cdb013ac8f4fb528f

    SHA512

    107a52c3009de1dec50d6111b6066dc96f2b91442c87e3ed771523f3e5be33c7ddda9bff84d3cb570b8d4ce86c00e491158036e27ca4495320c22ff052b5143e

  • memory/1212-324-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-320-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-321-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-322-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-323-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-0-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-325-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-326-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-327-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-328-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-329-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-330-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-331-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-332-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB

  • memory/1212-333-0x0000000000400000-0x0000000001CF5000-memory.dmp

    Filesize

    25.0MB