Analysis
-
max time kernel
138s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
22-11-2023 14:00
General
-
Target
æ·˜å®é‡‡é›†ä¸‹å•VV28.exe
-
Size
21.7MB
-
MD5
47664c6f22ecc22438161899f4bae933
-
SHA1
1cf558bbd8d8ff548391ee03606b1ce682580e30
-
SHA256
f5fb6410aa2151ceac5d1d9b70eb92e10f566d9a679fef0d420d8a656eb3c8f9
-
SHA512
5488a619a4b07e8423ab2381adb88a8bd657a9caf97c9a416a462890400ff601300ece8cff4a7b6c93fc58939a89b59de47acb987bb08058a892161da75fb8ec
-
SSDEEP
393216:O2ukHuBmX3Ek3RqUp9UBLu4GpD1rGpxO+bIo3xtptmVfwU40hKg+cuTBaUpFMUN:3uauAX393vUBS4G/GvOitptkfeyKg+FR
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\æ·˜å®é‡‡é›†ä¸‹å•VV28.exe"C:\Users\Admin\AppData\Local\Temp\æ·˜å®é‡‡é›†ä¸‹å•VV28.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dllFilesize
8.4MB
MD58b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA256982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
SHA5129d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
-
memory/1404-38-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-85-0x0000000005B10000-0x0000000005B37000-memory.dmpFilesize
156KB
-
memory/1404-4-0x0000000003B50000-0x0000000003B51000-memory.dmpFilesize
4KB
-
memory/1404-40-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-5-0x0000000003B60000-0x0000000003B61000-memory.dmpFilesize
4KB
-
memory/1404-6-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB
-
memory/1404-7-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/1404-8-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/1404-9-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB
-
memory/1404-2-0x0000000003B30000-0x0000000003B31000-memory.dmpFilesize
4KB
-
memory/1404-17-0x0000000006760000-0x0000000006FBB000-memory.dmpFilesize
8.4MB
-
memory/1404-20-0x0000000006760000-0x0000000006FBB000-memory.dmpFilesize
8.4MB
-
memory/1404-24-0x0000000005B10000-0x0000000005B37000-memory.dmpFilesize
156KB
-
memory/1404-25-0x0000000005B10000-0x0000000005B37000-memory.dmpFilesize
156KB
-
memory/1404-26-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-28-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-44-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-31-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-0-0x0000000003610000-0x0000000003611000-memory.dmpFilesize
4KB
-
memory/1404-1-0x0000000003B00000-0x0000000003B01000-memory.dmpFilesize
4KB
-
memory/1404-3-0x0000000003B40000-0x0000000003B41000-memory.dmpFilesize
4KB
-
memory/1404-30-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-46-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-48-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-49-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB
-
memory/1404-52-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-54-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-56-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-58-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-62-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-60-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-64-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-67-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-69-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-72-0x0000000006760000-0x0000000006FBB000-memory.dmpFilesize
8.4MB
-
memory/1404-71-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-74-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-77-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-83-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-84-0x0000000006760000-0x0000000006FBB000-memory.dmpFilesize
8.4MB
-
memory/1404-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/1404-86-0x0000000000400000-0x000000000352B000-memory.dmpFilesize
49.2MB