Analysis

  • max time kernel
    137s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2023, 13:09

General

  • Target

    c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe

  • Size

    4.4MB

  • MD5

    fc679381ba73c458363c8d8cbb26bebd

  • SHA1

    09fd9e139ffac86e3997018b4d555458ed32611a

  • SHA256

    c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7

  • SHA512

    53854a8354d8619279514f98c292b5c4d40900f7056df109af808327d1c88edd4b643a89b1bdf3d48f8409095d9e687f07ff53631461c4898d6395da2a9777bb

  • SSDEEP

    98304:yJqz0LA4ESEtt8X5SbWf+YFCWuqHOEJBAUZL:yJq94rdQaf+Hl2JV

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe
    "C:\Users\Admin\AppData\Local\Temp\c4d250f1e9e6e3e9e399823fc96979dfaf5e80775bfe2a71bfef4c4230f189d7.exe"
    1⤵
    • Sets service image path in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Fatnerd.sys

    Filesize

    38KB

    MD5

    0a4a21a4c3ed1b1fd2c30765ebb59920

    SHA1

    271409e023b98513d67bda4bc195f1b0c8adc68c

    SHA256

    4697d13517c5c348b534e68053c360bad8612b2cabe6abc84fd1dd5bc450c656

    SHA512

    63ad20fadc40af444f2fc58f38508eef3eee5daa89bcb622f59a2dbd343af72c916ad0152bd77670b86ba2936e4418593c9fca9b296135a0b2ba5920e31fd8f2

  • memory/4672-26-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-49-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-3-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-8-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-7-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-10-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-13-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-16-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-19-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-21-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-24-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-1-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-0-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-29-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-41-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-35-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-37-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-39-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-33-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-43-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-45-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-47-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-31-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-50-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-51-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB

  • memory/4672-2-0x0000000010000000-0x000000001003E000-memory.dmp

    Filesize

    248KB