4d046991c0f18ea3ecd72016cdac9822c4666203c90b85b00880bbf3f2c6af5b

Analysis

max time kernel
0s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d26bd846abb424765cb74e4465de003.exe
Size

585KB
MD5

0d26bd846abb424765cb74e4465de003
SHA1

35581bfc73c49dd8146bfa0f5905aa034a351809
SHA256

4d046991c0f18ea3ecd72016cdac9822c4666203c90b85b00880bbf3f2c6af5b
SHA512

f2af5a9fe19fc13892f593e8d1f998ac0f2f8f7bb8fb4bdfb1aa13bee9c9e56a7c2cf66e323bf442b32a6350d7b657b8631c69eb7fff39ec90e90939b0c641a0
SSDEEP

12288:+CmsgvD4TcUTxBEOBX05vNnyL+VKZgwbZ6524+uBKHEkJmI58+X:LiDAg805vNboZgMZaGAMEkJmMTX

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1068-0-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-2-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-1-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-141-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-142-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-143-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-144-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-146-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-147-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/1068-148-0x0000000000400000-0x0000000000521000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	0d26bd846abb424765cb74e4465de003.exe
1068	0d26bd846abb424765cb74e4465de003.exe

C:\Users\Admin\AppData\Local\Temp\0d26bd846abb424765cb74e4465de003.exe
"C:\Users\Admin\AppData\Local\Temp\0d26bd846abb424765cb74e4465de003.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-0-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-2-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-3-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1068-1-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-141-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-142-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-143-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-144-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-145-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1068-146-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-147-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-148-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-150-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-151-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-152-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-153-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-154-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-155-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-156-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-157-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/1068-158-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download