Analysis
- max time kernel
26s - max time network
69s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/12/2023, 11:23
General
- Target 1a861069aa54044b63a3f688509abe3e.exe
- Size 160KB
- Sample231225-nhfzpacefr
- SHA256 bb8264729a6ba947c398eaa2d45ab5b7bd721abe0a67d9b834a489af443cea30
Malware Config
Signatures
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a861069aa54044b63a3f688509abe3e.exe"C:\Users\Admin\AppData\Local\Temp\1a861069aa54044b63a3f688509abe3e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2716-6-0x00000000010C0000-0x00000000010C6000-memory.dmp
memory/2716-7-0x0000000077742000-0x0000000077743000-memory.dmp
memory/2716-12-0x00000000010C0000-0x00000000010C6000-memory.dmp
memory/2716-5-0x0000000000D60000-0x0000000000D72000-memory.dmp
memory/3512-4-0x00000000024F0000-0x00000000024F6000-memory.dmp
memory/3512-8-0x00007FFC03B6D000-0x00007FFC03B6E000-memory.dmp
memory/3512-3-0x00000000024F0000-0x00000000024F6000-memory.dmp
memory/3512-17-0x0000000002510000-0x0000000002516000-memory.dmp
memory/3672-19-0x0000000000080000-0x0000000000086000-memory.dmp
memory/3848-21-0x0000000000280000-0x0000000000286000-memory.dmp
memory/4132-1-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/4132-10-0x0000000002250000-0x0000000002C50000-memory.dmp
memory/4132-0-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4132-9-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4132-2-0x0000000002250000-0x0000000002C50000-memory.dmp