Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
07-11-2023 16:04
General
-
Target
58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe
-
Size
1.9MB
-
MD5
20ec40cf51b72055a91e2233f901b82c
-
SHA1
d995f6af37a28ce912c2cdec74c8419fb22f9962
-
SHA256
58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664
-
SHA512
212afde272dd61b9f0ed78e18c818dbdd6c8bf8b8f149f342f69e20eaeb84a7c007b0819cfca51d83a250496d1883e86a0aee6516fd43c14445f4f94321cbad9
-
SSDEEP
49152:ozXeC3Q1XEEAQ55PAyNpmm4GUb66bjtzcqJ/JyGbzQ6:YtQ10EP55PAyl4bb6cthRyGY6
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: RenamesItself 2 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe"C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe"C:\Users\Admin\AppData\Local\Temp\58f9600be17409013e538296cfa6ae26d25bbf5b255be827bc03aad5f9e38664.exe" 14562⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5eb46d105fb5dea11e7ab81df81657742
SHA1b84b8031d2fc4afff405566a357f6c4e8b823e5c
SHA256da9a50ad27c5667665f2c481199918a286d254668f8576e1a7906e80cac61526
SHA51290109c5c4102abd3a44e6f6948bcdc7fc6a85eaf422dfe837eb3d24705848e8479c93447099ccfbe689ebcc0f35e66e40cbe34f38b744791c0bbb0e88bc7c2f6
-
Filesize
1.9MB
MD5eb46d105fb5dea11e7ab81df81657742
SHA1b84b8031d2fc4afff405566a357f6c4e8b823e5c
SHA256da9a50ad27c5667665f2c481199918a286d254668f8576e1a7906e80cac61526
SHA51290109c5c4102abd3a44e6f6948bcdc7fc6a85eaf422dfe837eb3d24705848e8479c93447099ccfbe689ebcc0f35e66e40cbe34f38b744791c0bbb0e88bc7c2f6
-
Filesize
1.9MB
MD5eb46d105fb5dea11e7ab81df81657742
SHA1b84b8031d2fc4afff405566a357f6c4e8b823e5c
SHA256da9a50ad27c5667665f2c481199918a286d254668f8576e1a7906e80cac61526
SHA51290109c5c4102abd3a44e6f6948bcdc7fc6a85eaf422dfe837eb3d24705848e8479c93447099ccfbe689ebcc0f35e66e40cbe34f38b744791c0bbb0e88bc7c2f6
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
5.0MB
-
Filesize
252KB
-
Filesize
456KB