Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 06:21
General
-
Target
10eced74b11b17971d55c86b3b0ba45d.exe
-
Size
28KB
-
MD5
10eced74b11b17971d55c86b3b0ba45d
-
SHA1
c38779cdc00f4f76e7ca07372350800a6c4048ea
-
SHA256
79ff137be022e7e2034c77fad92844d6c8b1457714271af019c2fab2a0db1df9
-
SHA512
7af450e5dfc97394f0bc19f70ff36e487fc7d01e6f31cb2f6b0eeeb13a28bc86551ca4a0bc54ab00b8afd958ee56d9a47412cdd16c178c19f5bc459863120dc0
-
SSDEEP
768:4P05XnhsPWQNWk6zLJiJvhdl8OmONDz/+MPALEdLTMlXT9VH+KCPbUVaS:qNrnlALEpTMp+PMaS
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10eced74b11b17971d55c86b3b0ba45d.exe"C:\Users\Admin\AppData\Local\Temp\10eced74b11b17971d55c86b3b0ba45d.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\imsmn.exeC:\Users\Admin\AppData\Local\Temp\imsmn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5598b9fcb353df2796c3714062058666d
SHA15adaf6213bafdeb327626ef821c3e7595765c267
SHA25636e043b76b293b5261c0ae6fba1fd6bd8e61e39d8ef11ccff135fe171cb2a348
SHA51289b83ee72b8c236749a640876c24858be676bc43d1bb4cd1c0a3c9740bebacdd51a0d12d192cc6d42995debafb29d74cc2dcfa41b15cf9aa131806c3d79dd483
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB