d02955da6fd70406852331b91f74f79e39ece0cb6183e4e032ef09553a0a6da6

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

165786f24ea667685d976e5a99e572cb.exe
Size

20KB
MD5

165786f24ea667685d976e5a99e572cb
SHA1

f87f3e832b336be81b192844168ef487ad2b6857
SHA256

d02955da6fd70406852331b91f74f79e39ece0cb6183e4e032ef09553a0a6da6
SHA512

1696b438eef663e84a017ff1eccb3aa7b8eb61998cd963f020b8027cd7eaabcdbe95dec4f92493e32430f9c13d2e77adb10d0c885834b70cae8af41e413e6546
SSDEEP

384:Mk9M2+0532sGp1hOvl0Ek43UZWLJ3EwFnEPYbdfZ:xq2J3TGp1I90EM8LJ0AbdfZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1484-0-0x0000000000010000-0x0000000000021000-memory.dmp	upx
behavioral2/memory/1484-5-0x0000000000010000-0x0000000000021000-memory.dmp	upx
behavioral2/memory/1484-6-0x0000000000010000-0x0000000000021000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\NETVISION.exe	165786f24ea667685d976e5a99e572cb.exe
File opened for modification	C:\Windows\NETVISION.exe	165786f24ea667685d976e5a99e572cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

C:\Users\Admin\AppData\Local\Temp\165786f24ea667685d976e5a99e572cb.exe
"C:\Users\Admin\AppData\Local\Temp\165786f24ea667685d976e5a99e572cb.exe"
1⤵
- Drops file in Windows directory
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-0-0x0000000000010000-0x0000000000021000-memory.dmp

Filesize
68KB

Download
memory/1484-5-0x0000000000010000-0x0000000000021000-memory.dmp

Filesize
68KB

Download
memory/1484-6-0x0000000000010000-0x0000000000021000-memory.dmp

Filesize
68KB

Download