1082be0d813238d5065d3a9bc925c1265bcf365ae991d398486927e121716259

Analysis

max time kernel
0s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0cb4c00f4c216bcd3bc695ee5f1297d6.exe
Size

181KB
MD5

0cb4c00f4c216bcd3bc695ee5f1297d6
SHA1

38f635568878bf724394183d295709e2b6539273
SHA256

1082be0d813238d5065d3a9bc925c1265bcf365ae991d398486927e121716259
SHA512

3f052e21816560a46bef322c72a865e054cf72e43cd274f5af6e54c80d91ac1477da98439638563c11a2e372e2a03565ad446291928514e7833f56307dfbdb34
SSDEEP

3072:KFtj9DZiop52XIGrjKSBUZWijNutqGwSMixZhAJY/UAmFSm:KFZ9DEq52hUZcYGwS/xZ7UWm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/640-0-0x0000000000620000-0x0000000000696000-memory.dmp	upx
behavioral2/memory/640-21-0x0000000000620000-0x0000000000696000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0cb4c00f4c216bcd3bc695ee5f1297d6.exe
"C:\Users\Admin\AppData\Local\Temp\0cb4c00f4c216bcd3bc695ee5f1297d6.exe"
1⤵
PID:640
- C:\Users\Admin\AppData\Local\Temp\n4454\ins4454.exe
  "C:\Users\Admin\AppData\Local\Temp\n4454\ins4454.exe" ins.exe /e8861235 /u4fe0cf9f-1fe4-4abb-905a-57915bc06f2f
  2⤵
  PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\n4454\ins4454.exe

Filesize
11KB

MD5
062a06e4cfe15b514638b77dd6a109ff

SHA1
6aa133191dc24a616f89825537cd7686beec9e23

SHA256
9ea830c6d4c91da12a90084b3650f9a3dfb19fe5a4fe80fbff243db8738cdc2c

SHA512
8009218966a62a30c01eaf7b2bdb044572df2c1a3f64603b6f899cfb25491cff47ca40ea13217701b35438070c65d4210aad54780ff6c849d108f4e6d2a58670

Download Submit
C:\Users\Admin\AppData\Local\Temp\n4454\ins4454.exe

Filesize
119KB

MD5
5356c1b2f722c6b89972c6f94161d06b

SHA1
5c98b83615781b98ec680b5f4cb9adb12bd54e4d

SHA256
74ca66d8308a507d001c12c2c9fea6ade6dccb699cc8e7f0ebff4c1f7150f326

SHA512
26996df78d58e401f2a99324eb65b31ed4802e7b6aebc58c8fd1dedfcbe24cad90959b2906fb39286130c446676d49f2404cb2cb45ea380ef352b46406b3dfa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\n4454\ins4454.exe

Filesize
74KB

MD5
96917b17b90549230a9ca58bb02e123a

SHA1
eb19f5986b26e38aca96efe556dfcae355ddaac2

SHA256
251cdb449c0f5fafec508852428400c6c57de4fd68d4b3c53029f259ff06f3e4

SHA512
6cb18033b99d52eb83ea9d40dbe8d1e3912d5c3bab7200fc8998190162c67a049316a140c8fc8ae918c58a39a3edaca7ccb21c9b3d7abaf3b573a3bc1fee10da

Download Submit
memory/640-0-0x0000000000620000-0x0000000000696000-memory.dmp

Filesize
472KB

Download
memory/640-21-0x0000000000620000-0x0000000000696000-memory.dmp

Filesize
472KB

Download
memory/4120-13-0x0000000001480000-0x0000000001490000-memory.dmp

Filesize
64KB

Download
memory/4120-14-0x0000000073570000-0x0000000073B21000-memory.dmp

Filesize
5.7MB

Download
memory/4120-12-0x0000000073570000-0x0000000073B21000-memory.dmp

Filesize
5.7MB

Download
memory/4120-18-0x0000000001480000-0x0000000001490000-memory.dmp

Filesize
64KB

Download
memory/4120-17-0x0000000001480000-0x0000000001490000-memory.dmp

Filesize
64KB

Download
memory/4120-20-0x0000000073570000-0x0000000073B21000-memory.dmp

Filesize
5.7MB

Download