Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 18:21
General
-
Target
004fd0b808d32e4cd57b86dfd6888cf7.exe
-
Size
22.4MB
-
MD5
004fd0b808d32e4cd57b86dfd6888cf7
-
SHA1
54cc6cd80fe2cd825062d138c923540a40e66a61
-
SHA256
3d27e814116e5659f00c28e1cc0908d3fcf690a629565db910090e7c9f57299e
-
SHA512
e7dc153185eedcf36580b2544212a1276ba2d901554fb8ee4daead2db8874303d2ba09cc43ed8a689eaecdbc657dab2f68b5dd2ea8a460a2f7e0558dcb06cd60
-
SSDEEP
49152:c3+i9PkYByX4+i9PkYByX4+i9PkYByX4+i9PkYByX4+i9PkYByX4+i9PkYByX4+7:f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 7 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\004fd0b808d32e4cd57b86dfd6888cf7.exe"C:\Users\Admin\AppData\Local\Temp\004fd0b808d32e4cd57b86dfd6888cf7.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\klcxxiw\klcxxiw\fmbpela\vxrepai.exeC:\Windows\system32\klcxxiw\klcxxiw\fmbpela\vxrepai.exe -close2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -NetworkService3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5cc1742ef0a0b7fabe87129152b5a77f0
SHA12f9853cc37478cb925b610da4a10cd9816970588
SHA256f1e35f4fa11d129090a00fe9827195bd9a0c8a16e5f55f742175f05adc7e35c3
SHA5121ec4e411ea9bdb6c1bf8e5e33a216b236e2d6577ac1a972b09d5db7c21372038c789aac552804ec7a71b68b0f181b1ab2c34a2a8575bc52d8068f2e27f98a633
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB