9fe4164e94afef403f18126c1b999868407fd81522633971ea435903850a8e59 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 13:10

Sharing

Report Analysis Logs

General

Target

71256724477cf891eab9c4f290830fab.exe
Size

104KB
MD5

71256724477cf891eab9c4f290830fab
SHA1

a667e1bbf2d459481a50d62ffcd9e30cc6b50597
SHA256

9fe4164e94afef403f18126c1b999868407fd81522633971ea435903850a8e59
SHA512

58ae1ac88b981bc50cba401784e8efc8148848ce4b149a7c0539eb52a2952e770d9f19c3e3e7a257572f2518d3420d4fb4b246f6d04521fb54bfdd3a687a5515
SSDEEP

3072:80vdE+ZFzkMWSmKwjvCy0HRmqYh3IcE8ihQ:vdbvwvHHYAWQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2300-0-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/2300-3-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral2/memory/2300-4-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\agent.dll	71256724477cf891eab9c4f290830fab.exe
File created	C:\Windows\agentsvr.dll	71256724477cf891eab9c4f290830fab.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2300	71256724477cf891eab9c4f290830fab.exe
2300	71256724477cf891eab9c4f290830fab.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3484	2300	71256724477cf891eab9c4f290830fab.exe	48

C:\Users\Admin\AppData\Local\Temp\71256724477cf891eab9c4f290830fab.exe
"C:\Users\Admin\AppData\Local\Temp\71256724477cf891eab9c4f290830fab.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2300-3-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2300-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download