Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 10:49
General
-
Target
c01008d3b4d147a0dd86b8f46c1890a0f05e0509cf171280285810519ac14aa2.exe
-
Size
536KB
-
MD5
ea23b75d92c9353daa434a4561173ad0
-
SHA1
74448e03273b8bd47e08c90c9fef4ff605d773ea
-
SHA256
c01008d3b4d147a0dd86b8f46c1890a0f05e0509cf171280285810519ac14aa2
-
SHA512
53e2ae7be761c77dae4899ec60eb0fd617d64db2736b3bac7ff1347b8d64fa69c00d251746b9dc0131d67014eb9efeea89a1525617e89885ef5d886a8fb87f83
-
SSDEEP
12288:ahf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:adQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\c01008d3b4d147a0dd86b8f46c1890a0f05e0509cf171280285810519ac14aa2.exe"C:\Users\Admin\AppData\Local\Temp\c01008d3b4d147a0dd86b8f46c1890a0f05e0509cf171280285810519ac14aa2.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
938B
MD5a0b82a6a0cf7d6824295d5e9ce0b1376
SHA1c7c7f602ccf6a05f01a925476da2d447f9e331a6
SHA2563ec9faa42a902f13a53d6aeb36e56d35c2f82eb28f7b5e8eb30e172a84d5c432
SHA512b7b19e1b2020c7f5e6512cd5f292d06f9372cf6b53bbaaa6fde2cabda8e1cb7cfd0fbda5ba1e7a619912b9ec7c30d6a67e0986745d4145005d54d7af65b94a3b
-
Filesize
687B
MD54efd4f6d9c6d2fb581a0c0e0387fdce7
SHA17364d619fa43a3bcd6a2c379babe9169cded47ef
SHA25620558404e4f5f7db54804fadbf4cec1b84a379ceaf42cee92014528008a3a693
SHA512ad1c1d947d1958b9d3179cb3884c392da52470b55ab923e5e4a1577ced36b571370ab4a5a65fff39f4d614614107dc4f40fec6f86383478d5fbe751b3dbdf635
-
Filesize
520B
MD517fb97ca1109d1df10784830d50ee6bc
SHA15099f35361b44cb46de8fc4cda664bbbb2aaa905
SHA256eae7c5c05b061255e154a9fc6b113677dd077986418f48150de8c8f340770a8f
SHA5121d6094e50edc7b857828f23b5dfa1b797f6c825e9fdc60305d9dc1614a4a9c4089f5624000f978f29f954bff93941218b3d6390029b3b9daf5e3840fae8853c9
-
Filesize
192B
MD5d91fef9f96763e39954592de1f002b54
SHA1475023a4f57e53f51a51c85cc5ce6067c2ce8509
SHA256bfddd21700b0a741e82bbaeb1d34a31eeb1cae88eee939a0a07a8dc1ce22bfdf
SHA5120cb6ae2580f84eb32e9f1758645cc6fbbf78925b45fea48777e505445870568baf0424f1ed0fca75d5235f87ea1af08ba8d6d7afd0ffedd05f9ac4408627aec5
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB