Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 05:50

General

  • Target

    72faae5ab5df6ec8cf01da8f71b7d3b1.exe

  • Size

    11.0MB

  • MD5

    72faae5ab5df6ec8cf01da8f71b7d3b1

  • SHA1

    13e47ec3f668867c06fa00eced2cd338d6d000c3

  • SHA256

    61301b818dfb1401e3354bcd7ceeb461230de86f63cd7b6a0716616aaf01477c

  • SHA512

    b9da7d3b208b300f98887862cb928427396509eec0f3d9e81efb3f996ca5b098be037a865f246f4cfd0b608a205449f7b197a1709909ffdbb3ace0092a4154d7

  • SSDEEP

    98304:XMhSIsXcqnY1DcZFeDG35mCckFR+vicS43cxNg8R3PG35mCckFR+vicS43:XMhOXVY5wKm33FR+6ckJ/m33FR+6c

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72faae5ab5df6ec8cf01da8f71b7d3b1.exe
    "C:\Users\Admin\AppData\Local\Temp\72faae5ab5df6ec8cf01da8f71b7d3b1.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Users\Admin\AppData\Local\Temp\72faae5ab5df6ec8cf01da8f71b7d3b1.exe
      C:\Users\Admin\AppData\Local\Temp\72faae5ab5df6ec8cf01da8f71b7d3b1.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\72faae5ab5df6ec8cf01da8f71b7d3b1.exe

    Filesize

    77KB

    MD5

    b8c6a297f5aa3bf035ac5f27ff3fa276

    SHA1

    cbdeed1f31b22381304b371fdcc47556c52db3a6

    SHA256

    e6b1bfcb02828b726b83e91fca11fd36dccfbc5575cb46d5a8280f62cfae76c8

    SHA512

    25946808846bc7c04df10868b73bfdb286123771b841029545af0770adb586a6955cad84679db0ac0a28e866136849d3c688f575ff92cdd0727702202d939ee1

  • memory/412-15-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/412-17-0x0000000002190000-0x00000000023EA000-memory.dmp

    Filesize

    2.4MB

  • memory/412-33-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/3928-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/3928-1-0x0000000002240000-0x000000000249A000-memory.dmp

    Filesize

    2.4MB

  • memory/3928-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/3928-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB