Analysis

  • max time kernel
    5s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 01:20

General

  • Target

    48d6ea9f275c17e3fdb8f45be0dfd325.exe

  • Size

    556KB

  • MD5

    48d6ea9f275c17e3fdb8f45be0dfd325

  • SHA1

    84ddb0654d1ce7ff0bb8501a4eac5bb76445d11a

  • SHA256

    622d2e595c00773073d9373c6aec4b1f9ca87bf3f109a1fdd5570b6a598ae909

  • SHA512

    d20a5726ae1676299d0aebec85191b04a144777f6f4def517a3ad00f0db32df162250c6c6f26bdac278f67656bc7ba387954052162bdc1b584550fa67599984e

  • SSDEEP

    12288:thuXL+hWRPdHbOCYlLALynynzw/S95Ay9HKJkq9j2wLvMM56:tMQ85bOXuyUaU5Ay9qJXVvvMM56

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48d6ea9f275c17e3fdb8f45be0dfd325.exe
    "C:\Users\Admin\AppData\Local\Temp\48d6ea9f275c17e3fdb8f45be0dfd325.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1948-0-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-1-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-2-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-3-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/1948-157-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-158-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-159-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-160-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-161-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-162-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/1948-163-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-164-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-165-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-167-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-168-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-169-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-170-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-171-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-172-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-173-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB

  • memory/1948-174-0x0000000000400000-0x000000000051D000-memory.dmp

    Filesize

    1.1MB