Analysis
-
max time kernel
162s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
10-10-2023 22:21
General
-
Target
2d5300a97bda02a8c2a07eed49eabcfff1cfc94c82a3fe2a76f8b3fdbb16fd9c.exe
-
Size
4.5MB
-
MD5
f785ba32a1a864ffac675d3c25f0e2d2
-
SHA1
6c4214617cb7abd4d245179f04d1d6eff7b08b33
-
SHA256
2d5300a97bda02a8c2a07eed49eabcfff1cfc94c82a3fe2a76f8b3fdbb16fd9c
-
SHA512
55e7763fbde84577ef8495a39e54d4507c484d0484ca9265430622d439563aed800750085a23821bf506b983b64a2f80f15bd270a03d03deb96b60492445d4b1
-
SSDEEP
49152:kAL2w8IDI5DAar2Dkw7q9iRHbvlnCWPhkRtZnNs4T3Bet25zzry2uECF:L2hT5s+jkdy1x1zHNC
Malware Config
Signatures
-
Modifies RDP port number used by Windows 1 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d5300a97bda02a8c2a07eed49eabcfff1cfc94c82a3fe2a76f8b3fdbb16fd9c.exe"C:\Users\Admin\AppData\Local\Temp\2d5300a97bda02a8c2a07eed49eabcfff1cfc94c82a3fe2a76f8b3fdbb16fd9c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\6Ss9PNVe\S0X0Pbs9.exe"C:\Users\Public\Downloads\6Ss9PNVe\S0X0Pbs9.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\xxxx.ini3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5e39405e85e09f64ccde0f59392317dd3
SHA19c76db4b3d8c7972e7995ecfb1e3c47ee94fd14b
SHA256cfd9677e1c0e10b1507f520c4ecd40f68db78154c0d4e6563403d540f3bf829f
SHA5126733f330145b48d23c023c664090f4f240e9bbeb8368b486c8ee8682ec6a930b73275e24075648d1aa7e01db1ec7b7e259286917a006ba9af8fb7cba3439070a
-
Filesize
36KB
MD5f6bf82a293b69aa5b47d4e2de305d45a
SHA14948716616d4bbe68be2b4c5bf95350402d3f96f
SHA2566a9368cdd7b3ff9b590e206c3536569bc45c338966d0059784959f73fe6281e0
SHA512edf0f3ee60a620cf886184c1014f38d0505aac9e3703d61d7074cfb27d6922f80e570d1a3891593606a09f1296a88c8770445761c11c390a99a5341ee56478aa
-
Filesize
358KB
MD51eea54e7d8da117c7f1ec5a647189832
SHA19c39c0ffee626a03f3712c327656708a46f85c78
SHA25690ba6b523b9d35cf2f1ca2e402eceeecf94cda78aa13a48a9e1e75c3687c97fa
SHA51265a0f9a618f524f950200bfb4f183fc0c7c9b5b8e0f4baf0d519f28e0e2f3f04e02ca805492ff43a235d272f3ea06adb3a825c9ee3c86ce10f4fb7640d29f755
-
Filesize
132KB
MD54149f0d8db7f8de3a56c630b9980bbdc
SHA1c3c642f00b270f7f10eb0ea7c5eefce17f0ea80b
SHA2565e7393708215984f021292743cfd59cb7fe2e03dd4d504663b19768efb4d84c2
SHA5125dd2e1fe0aa82d91b591fd4b01e180b9888ba4c8d36107d64bde32b42a959425e38bc15cf79b677eda3a6b7d6831acde7cac99622dd0ef834ad2258ced1d2921
-
Filesize
529KB
MD549d595ab380b7c7a4cd6916eeb4dfe6f
SHA1b84649fce92cc0e7a4d25599cc15ffaf312edc0b
SHA256207d856a56e97f2fdab243742f0cfcd1ba8b5814dc65b3798e54d022ce719661
SHA512d00ed0d9baae96ccbaf1262b4a4aaf4468e4ace6cebcea81e74d830bf414d9bc61068b8fb0eefa742add14aec47284f3adc11be26c8b8d66bfae4c498f2a4110
-
Filesize
53KB
MD5a2d73bcfbf7df25ebc202742e6b8cbad
SHA18f6c17ad94766e4b2d3b59578d3b35b37e9b4ac2
SHA25607a4d9a2e853399163b3f8f0555b9ffdddf0f91697e3f7f9d0ca48115c43b646
SHA512ed6d6d2619e8bd640e5d16d5efed64857c044e12cc39209cdbf636ed1afc42d637061890a0ec2d39643a5a63345d77c7da2d34e2be6594f8fd76b7f7ee79851a
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
72KB
-
Filesize
1.3MB
