Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 08:34
General
-
Target
18d42d1788d8f39747bb325708dd32ce11bb559cfc3cf42ac1bdc7778b71a7d0.exe
-
Size
2.0MB
-
MD5
5a44f2c856ba3f5ac4463fe090c96acd
-
SHA1
f6fa9f6adfc4d9e72f251a5d2e577fd22b6e512d
-
SHA256
18d42d1788d8f39747bb325708dd32ce11bb559cfc3cf42ac1bdc7778b71a7d0
-
SHA512
9442b2925ac013b18aa7a2650297ec7e98a8a9490295f97a8d3ca4568f23082961d48f29e72cdc78d7e629cfc60353342dd17035f7e8ce0177de5a26fc7b003c
-
SSDEEP
49152:TKUyrNFjUUxMuZC0hYjDmLijRpaGM9lLs6Or:TyhFjUUxjZCQ+vjm9Jsx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18d42d1788d8f39747bb325708dd32ce11bb559cfc3cf42ac1bdc7778b71a7d0.exe"C:\Users\Admin\AppData\Local\Temp\18d42d1788d8f39747bb325708dd32ce11bb559cfc3cf42ac1bdc7778b71a7d0.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\»ªÄÏ»¢¸üгÌÐò.exeC:\Users\Admin\AppData\Local\Temp/»ªÄÏ»¢¸üгÌÐò.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
MD5d28c31cbf49568bd384bff3e14a190f2
SHA14530ea8ea7ca2a6348aaaa55846a688dfe3b2f2d
SHA256e77e4a32755ea717d96c388dce52b7d9cccc798dafb0cfb5ff6219f19f6f714c
SHA512042f03fc07657b35629f8d8673c29746489440c1bdb97673783cbc8431c9e316bd775e2a877a8b34f5504cdceaf76191b1024d130c4c0b336031378815f60c16
-
Filesize
640KB
MD5d28c31cbf49568bd384bff3e14a190f2
SHA14530ea8ea7ca2a6348aaaa55846a688dfe3b2f2d
SHA256e77e4a32755ea717d96c388dce52b7d9cccc798dafb0cfb5ff6219f19f6f714c
SHA512042f03fc07657b35629f8d8673c29746489440c1bdb97673783cbc8431c9e316bd775e2a877a8b34f5504cdceaf76191b1024d130c4c0b336031378815f60c16
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
64KB
-
Filesize
64KB