Analysis
-
max time kernel
169s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 11:00
General
-
Target
bd6e03a16c5f7d2f5b049eb31b34a57a46c290644b90bf18c587aaa2282c7032.exe
-
Size
536KB
-
MD5
fccdb671b32b3a7568bc5ad380c8a064
-
SHA1
eca1c900291ebc4f4d097ed0c741c51df90e7002
-
SHA256
bd6e03a16c5f7d2f5b049eb31b34a57a46c290644b90bf18c587aaa2282c7032
-
SHA512
9fef59c413fb7ba43df029ab960724bbc0c6f9263704022b1f190aa234c5d9d166f3ed253b0739d7fb27563b90fb06f67edb05fcd6d499e10943885bf6a7333a
-
SSDEEP
12288:8hf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:8dQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd6e03a16c5f7d2f5b049eb31b34a57a46c290644b90bf18c587aaa2282c7032.exe"C:\Users\Admin\AppData\Local\Temp\bd6e03a16c5f7d2f5b049eb31b34a57a46c290644b90bf18c587aaa2282c7032.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56f2fe23b3a9817243e2e1e61d5fa9593
SHA168f501cfbe9abdf1a121b71155c6a52ef5c74870
SHA256055634aa6efc859784b584eef57d621586c3964b9578fa3fc2614fcc3dae8feb
SHA51207c1a03120c05f88a0aa89d93d53ee7c721306af166f363570c8200fd72cb8a532f9a656d3336fe53416978b07c65668c21cd178952ff518d1663bf5095ee538
-
Filesize
939B
MD5a78e2314e1268a3d65ee1de075fcdc32
SHA1d30b3e70a713334bdb6c499355b8680c7bd1b847
SHA256fae0676a046fd42300ee3b94de3198b281882d51791abc1012a6bc48d0bffcc2
SHA512455a38f5b77322d2d2d71ce83bb9c2b56e5fde87b080a508c0e4a64e1c1b869c23fde3f622295e643598ebdf7915388ba45a553402baa3fcb847ebac095f16e1
-
Filesize
520B
MD508d650e50374084acd690f918fb4ffd1
SHA1f00fcc1860d341c0d937f762949c970d4df91b7f
SHA2567439e95df43db4f8627c81c71404cb82c611ea12b9ff8a385f4221fba320dd56
SHA5126604b59cdc9c4e038ce2c90466dc6f182336903d034c27526155799defb1a4a8c1e67669a53fc8ca2eced4a7dea85be059ae27a70ef585aa72a22cd727213949
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB