6c1e41ee14bd3f304c69e54412b5c732e055d082a0ca17a80278201eb80b09c2

Analysis

max time kernel
42s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0abfeea8052c65db343b0f40662c6158.exe
Size

13KB
MD5

0abfeea8052c65db343b0f40662c6158
SHA1

f842cce03bd696d352d731779f6a776e30f3eab9
SHA256

6c1e41ee14bd3f304c69e54412b5c732e055d082a0ca17a80278201eb80b09c2
SHA512

8efe08488dfe5601b0849163b67d7725cea5f7ef9c48198a3602a42048655f8fa85d29c467de94ce0b241f2e96dd6dd6df4f62730d72471fb92119893bce0bb2
SSDEEP

384:a/gPsXVsdS0dflYjSqY8TPYnTTh+8WAOJWIs:a/VMl7x8TWh8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2552-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2552-3-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/2552-7-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Runs net.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	0abfeea8052c65db343b0f40662c6158.exe

C:\Users\Admin\AppData\Local\Temp\0abfeea8052c65db343b0f40662c6158.exe
"C:\Users\Admin\AppData\Local\Temp\0abfeea8052c65db343b0f40662c6158.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2552
- C:\Windows\SysWOW64\net.exe
  net stop "WMDM PMSP Service"
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "WMDM PMSP Service"
    3⤵
    PID:3020
- C:\Windows\SysWOW64\net.exe
  net stop "DefWatch"
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "DefWatch"
    3⤵
    PID:3216
- C:\Windows\SysWOW64\net.exe
  net stop "IPSEC Policy Agent"
  2⤵
  PID:2852
- C:\Windows\SysWOW64\net.exe
  net stop "McShield"
  2⤵
  PID:1496
- C:\Windows\SysWOW64\net.exe
  net stop "Symantec AntiVirus Client"
  2⤵
  PID:992
- C:\Windows\SysWOW64\net.exe
  net stop "Norton AntiVirus Client"
  2⤵
  PID:960
- C:\Windows\SysWOW64\net.exe
  net stop "Norton AntiVirus Auto Protect Service"
  2⤵
  PID:448
- C:\Windows\SysWOW64\net.exe
  net stop "Norton AntiVirus Server"
  2⤵
  PID:4952
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Internet Security Service"
  2⤵
  PID:2200
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Internet Security Proxy Service"
  2⤵
  PID:2860
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Internet Security Accounts Manager"
  2⤵
  PID:3424
- C:\Windows\SysWOW64\net.exe
  net stop "Norton Antivirus Auto Protect Service"
  2⤵
  PID:4344
- C:\Windows\SysWOW64\net.exe
  net stop "TrueVector Internet Monitor"
  2⤵
  PID:4348
- C:\Windows\SysWOW64\net.exe
  net stop "Zonealarm"
  2⤵
  PID:3760
- C:\Windows\SysWOW64\net.exe
  net stop "Messenger"
  2⤵
  PID:1268
- C:\Windows\SysWOW64\net.exe
  net stop "Event Log"
  2⤵
  PID:4444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton Internet Security Proxy Service"
1⤵
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Event Log"
1⤵
PID:3376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TrueVector Internet Monitor"
1⤵
PID:2392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Messenger"
1⤵
PID:368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton Antivirus Auto Protect Service"
1⤵
PID:1316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton AntiVirus Server"
1⤵
PID:2880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IPSEC Policy Agent"
1⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Zonealarm"
1⤵
PID:4712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton AntiVirus Client"
1⤵
PID:2212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton AntiVirus Auto Protect Service"
1⤵
PID:4264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton Internet Security Service"
1⤵
PID:4068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Norton Internet Security Accounts Manager"
1⤵
PID:3292

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Symantec AntiVirus Client"
1⤵
PID:5000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "McShield"
1⤵
PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-3-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2552-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads