Analysis
-
max time kernel
180s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 11:34
General
-
Target
a58311743835e02d003d9d1f5c5084704f7f1289e8c71a8b3c2c4f86c8484b30.exe
-
Size
536KB
-
MD5
c8a584eb8d26ed207442452d82b871c2
-
SHA1
58c239091cb4954c1ad067eff81a350221a9d287
-
SHA256
a58311743835e02d003d9d1f5c5084704f7f1289e8c71a8b3c2c4f86c8484b30
-
SHA512
eb5da9130d548fb72de45ddadb9039ae5c76ac0a643a74ec42ada8a48582913f7756320f01bb0b116ced230e3b156a4aa47170a3f150187f1438662d18153f33
-
SSDEEP
12288:zhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:zdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a58311743835e02d003d9d1f5c5084704f7f1289e8c71a8b3c2c4f86c8484b30.exe"C:\Users\Admin\AppData\Local\Temp\a58311743835e02d003d9d1f5c5084704f7f1289e8c71a8b3c2c4f86c8484b30.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54d050164a30b6984877e708b688cb68a
SHA14b08de5f0a16824b2d878f69420bf0d3041df1f0
SHA256e93952efeaa1da5ecfce295349c6b2eb0dea9d497d73466fb97e8bab20e1d734
SHA512a2ca6da56d10d7cb95180efbfd91692a232dcf82ced4dfee0a275c884405c9ea1506d6100ed6f4b803cdc608f88cf86ac909d32cd283330aef262b9a67519d60
-
Filesize
1KB
MD52164869438b1c582dd59087f8edcab39
SHA1cfff723358916981534675e7866a17deffba6c85
SHA256cd62bdce0cd913826653fb50b9e7e75f56e269c2a8d1791a71bda52e7a6bdb97
SHA5121cde513d61fe5400640b022f9017a91eec791e6f66a8a493b42a4ccbc47d8537d4940f761fb9eadbd51f1870212f334c03c333139535858cbf7ae491cf5161bf
-
Filesize
210B
MD5eba97aa7aba4c28a53689a25d60c2125
SHA19aa502c478f961ff9b5a7c773a9d6907e1fc8f14
SHA2560073a5277019c85f919a7f1ef3dced2037652be9423542b1d16404d8f460344e
SHA5124c2293cfb721f5e3630caa0defd5048014e46a1c05e2f786b275675164f03a914ed54d50caef14f39a2a4069360ef8e01b6c25a3b07e53c6bfcf6689a7f5a900
-
Filesize
502B
MD5e2c101e3c9d47c8f1d14ece694c6d5a2
SHA155c3048760bbb7052c1da9ecdcbe5249f78ad2f7
SHA25619c06ebdd467f1783742b45dcfe1e6b01745a8a17195e6699ce5ae7da46f61e0
SHA512f7d6f3c292629ab1a01db7e537000d28d8cd23a26c23af80eed2ce14efd5ca62b03bd3c130da9dd81a092a669fd979ed03827257989b55bb2b0099db335bbfb8
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB