Analysis

  • max time kernel
    143s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 04:46

General

  • Target

    xpepius_setup.exe

  • Size

    735KB

  • MD5

    94a8383a2774a9156260c03cb602c757

  • SHA1

    cb0f601b7837ee7a056f56a152d342a6f95cbfcb

  • SHA256

    d6f527c0c33794dff900203ffbf71952da357eb6f418f7e9eca10c891939d3ae

  • SHA512

    39816e336d28f43af7f7dd76444a1522bb8f86ba25f5b7b7b82421051f3930f20e482794712ddcc54670cfbda46b978d20ec19cc923d356ae83154c724795644

  • SSDEEP

    12288:/I/0ae+O46Fyx42b6XLtFWA1krC4uZVEfcPOCzuYPnXOAVaYoCJnbfs8f9V6+2gR:/I/0aTlxpb6XPEr56vFPzJbfsYP6+eql

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xpepius_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\xpepius_setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst5C07.tmp\ioSpecial.ini

    Filesize

    682B

    MD5

    f921a159059547f8ef854b45c53099cd

    SHA1

    3d85a0048058d9f5aa60a8e5e5dad18479c8b3f0

    SHA256

    0fa22c8a65d6d969a505fe71bbc0aff2ff528c30178bc05bf80358b110a5681c

    SHA512

    8bbbbdd53e7c935f3afbdb063c9d867de75ebebe825e49feefdee464df6fcdb1b6248e635e982ca3d20c03084707a8d79e3ca9dfdccb9f6d70cd18a2769ee213

  • \Users\Admin\AppData\Local\Temp\nst5C07.tmp\InstallOptions.dll

    Filesize

    12KB

    MD5

    07f3b3445f66e1089567796bf3c8be78

    SHA1

    851eb574c1067b23a654f8aa47b17ef599b24d1c

    SHA256

    a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1

    SHA512

    8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3

  • memory/1748-0-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1748-2-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/1748-1-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/1748-11-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1748-81-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1748-82-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB