e80bab4cb97cd8a9d91e5ea4d2bdcbbcc0977c004529194ab1870b8c6c7d6a53 | Triage

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 04:54

Sharing

Report Analysis Logs

General

Target

ts.exe
Size

5.5MB
MD5

8e994054ad00ea6590d127317b74d681
SHA1

20c213e11feef9db9640d21e61b1cc3105e8b93f
SHA256

e80bab4cb97cd8a9d91e5ea4d2bdcbbcc0977c004529194ab1870b8c6c7d6a53
SHA512

3314ea8833be6de5fd25c9e6f1c2acecf3bc57608ae1d90d825861b2f59f8c1fee3af7da60f22b2fbaa4c9de2eaec1970997e245fd790903cfef1f66faed40e0
SSDEEP

98304:ScyhGwhhHX4WKT/4WasQjWsHOhtHfeB7QgNoHanN6iadtDJlOLxlf:SzhGwhhZk/fasQz4BEQgTnN6iav9sTf

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3572-0-0x0000000000400000-0x00000000012DD000-memory.dmp	upx
behavioral2/memory/3572-1-0x0000000000400000-0x00000000012DD000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3572	ts.exe
3572	ts.exe
3572	ts.exe
3572	ts.exe

C:\Users\Admin\AppData\Local\Temp\ts.exe
"C:\Users\Admin\AppData\Local\Temp\ts.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3572-0-0x0000000000400000-0x00000000012DD000-memory.dmp

Filesize
14.9MB

Download
memory/3572-1-0x0000000000400000-0x00000000012DD000-memory.dmp

Filesize
14.9MB

Download