Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12/10/2023, 08:26
General
-
Target
f92adbaee78c952d0d86ba183d6b4bbd0c60d2439304cf774f6346924d8f7934.exe
-
Size
14.3MB
-
MD5
30238b45cf4900ee9630ec0ccdb50469
-
SHA1
0c1d515af93a47bc0873a5e5f376063113e97f01
-
SHA256
f92adbaee78c952d0d86ba183d6b4bbd0c60d2439304cf774f6346924d8f7934
-
SHA512
fed3bbc00ad28eaf4772c2cb4d7af3bda8324b001b56c3c4b8095690aec05d0f543c2731961c296fcca624626d119af1d273bf8040c6f86214c2e61d59be526c
-
SSDEEP
393216:eBNteCLuOR8f25brlkVCwASNbVfe83qPFq6oaBmCGj6ugGnQW:eBNtAjebkoSpexFJo7CS6ugGQW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f92adbaee78c952d0d86ba183d6b4bbd0c60d2439304cf774f6346924d8f7934.exe"C:\Users\Admin\AppData\Local\Temp\f92adbaee78c952d0d86ba183d6b4bbd0c60d2439304cf774f6346924d8f7934.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\¸üгÌÐò.exeC:\Users\Admin\AppData\Local\Temp\¸üгÌÐò.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD580bccd3e6260683346673137eaed388e
SHA131e4943cfa22d79892a8a3d34c9d950fca35901c
SHA2569e6acd6ea667943f6034e270247c57a29a430415468a9dac8ca0be1db2535e0a
SHA512b1952260b094de10f2edf2dfdd23b4598214a8a8602384b3666b571e7be8677a29b1df88738b9ed2f41598a45e7519d44796d1ae55eb7bbd5f0cb208222fde94
-
Filesize
788KB
MD580bccd3e6260683346673137eaed388e
SHA131e4943cfa22d79892a8a3d34c9d950fca35901c
SHA2569e6acd6ea667943f6034e270247c57a29a430415468a9dac8ca0be1db2535e0a
SHA512b1952260b094de10f2edf2dfdd23b4598214a8a8602384b3666b571e7be8677a29b1df88738b9ed2f41598a45e7519d44796d1ae55eb7bbd5f0cb208222fde94
-
Filesize
98KB
MD51dd2a4a0f4d21eb65db5895fca2ca489
SHA1b0c0617f6f66b35e255ec9824cde41f382a60e80
SHA2567a7f037bab8024a9d17fb225cc4aa04133081135ecc4be5bbb889c0fbebd7e0c
SHA512214e7aa56e820ebec87a778293871672f7c4e92d06bdf5ba18a2fc536003b2e15ebdce65c1ae3c927a16fcfe865c1720a7262e7a700459c66b4ae563374518ae
-
Filesize
788KB
MD580bccd3e6260683346673137eaed388e
SHA131e4943cfa22d79892a8a3d34c9d950fca35901c
SHA2569e6acd6ea667943f6034e270247c57a29a430415468a9dac8ca0be1db2535e0a
SHA512b1952260b094de10f2edf2dfdd23b4598214a8a8602384b3666b571e7be8677a29b1df88738b9ed2f41598a45e7519d44796d1ae55eb7bbd5f0cb208222fde94
-
Filesize
788KB
MD580bccd3e6260683346673137eaed388e
SHA131e4943cfa22d79892a8a3d34c9d950fca35901c
SHA2569e6acd6ea667943f6034e270247c57a29a430415468a9dac8ca0be1db2535e0a
SHA512b1952260b094de10f2edf2dfdd23b4598214a8a8602384b3666b571e7be8677a29b1df88738b9ed2f41598a45e7519d44796d1ae55eb7bbd5f0cb208222fde94
-
Filesize
4KB
-
Filesize
33.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
33.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
100KB
-
Filesize
88KB
-
Filesize
33.5MB
-
Filesize
33.5MB
-
Filesize
204KB
-
Filesize
100KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
344KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
33.5MB