Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 11:00
General
-
Target
0e460d10f54550e3c85cb7984812ee4234476c550c02eb8ffb770803c5d1b2e3.exe
-
Size
536KB
-
MD5
10a489b443ede90cc3748fd4cdfa5a0a
-
SHA1
24b02d71e7d9a970b43c2523bb7d094ea04fac89
-
SHA256
0e460d10f54550e3c85cb7984812ee4234476c550c02eb8ffb770803c5d1b2e3
-
SHA512
e7060eaaa03fc07b26fc09f744dc5ffecdac558d527bcf8c575ed177e23bdf8eb7bec8985fe933e9e6a6342d37e3310fb1a19ca5545d61880e6e8db7d1fb1231
-
SSDEEP
12288:Xhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:XdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e460d10f54550e3c85cb7984812ee4234476c550c02eb8ffb770803c5d1b2e3.exe"C:\Users\Admin\AppData\Local\Temp\0e460d10f54550e3c85cb7984812ee4234476c550c02eb8ffb770803c5d1b2e3.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51fafb3567a7486402df6a7dee0a648a1
SHA1225091f3b600bbedaeca86892a0216f8f08b1d35
SHA256d3d749abcf7ab2652b9969a92fbf2f5178f4a3f78cd15c30e45fbddb0c83d2e3
SHA512afeabc2c9914fb6370320d3a47d72048c40c3455fda4925956eb6d84470496fc1e40d612d3c2c1e371c753601580525cb0a221387fb618d7c30b7dafe5c7e771
-
Filesize
939B
MD5a78e2314e1268a3d65ee1de075fcdc32
SHA1d30b3e70a713334bdb6c499355b8680c7bd1b847
SHA256fae0676a046fd42300ee3b94de3198b281882d51791abc1012a6bc48d0bffcc2
SHA512455a38f5b77322d2d2d71ce83bb9c2b56e5fde87b080a508c0e4a64e1c1b869c23fde3f622295e643598ebdf7915388ba45a553402baa3fcb847ebac095f16e1
-
Filesize
502B
MD503c8e580fc8417cbbdfc321b8e95de30
SHA199d3ea35a60796ddcd51a3692ab6a11c964217ac
SHA256446a85e0344cfe270f3d35ef428124e5d55e89792bcfe61776f1b52bc99709dd
SHA5121dd6ef76973c6cbe150bd8042c0fdb8b73f9d3b075531684baa45f337e2aec6821a1d76c9e8ea975f4a11cf178daae3cfd5678744806728581b851fb4c3e8910
-
Filesize
520B
MD532a9a28a84a27792c83b897248d3f0e3
SHA1bee211ab0a2f445cce08cb450a96474d2c5100f4
SHA256d5e23bceb845ee329592a9f31df2a329f84c0c4d263fc1929c72bfae67e6f2d1
SHA512c9ed642c736dbc5369daf1565fce049e9c6713be981a3433916f5d0daf4b67eaa1c20fe139b54bbbe72eef13a8fc2117b16ca05ebd5b69f185a62d85e6a74d57
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB