Analysis
-
max time kernel
163s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02/01/2024, 08:18
General
-
Target
213fb61afcb95c40e44ac58a56b8eb9a5f5d7209011e72bcb170efe1f0a6c871.exe
-
Size
536KB
-
MD5
2ef5ea9cbe02d2f10536c6a171d9df00
-
SHA1
3c6d62a7e160b7ba166e068e31db24ae7b9a9f3f
-
SHA256
213fb61afcb95c40e44ac58a56b8eb9a5f5d7209011e72bcb170efe1f0a6c871
-
SHA512
4fb8b150c5e8c397182c7c0bd0b2377c02f94b541b442ccd5ce17bf123f770b2dd19aac2eb9d16e2856c69a2af0c5f205f24f2bcb0ff73ff5151546857ea1150
-
SSDEEP
12288:Hhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:HdQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\213fb61afcb95c40e44ac58a56b8eb9a5f5d7209011e72bcb170efe1f0a6c871.exe"C:\Users\Admin\AppData\Local\Temp\213fb61afcb95c40e44ac58a56b8eb9a5f5d7209011e72bcb170efe1f0a6c871.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ac014cef6cfe67878d8c40ab763bdf4a
SHA19213d01d7e180e9d62f8bcf12e41a3c1024a7240
SHA256bc357cfeb8ec83a9f81951778964baf14f360e23f870da4301f1ea222de70f72
SHA5128cac47116a686f8fdbf73dd5980ab41907a58cbd86e71bd61e7a51350fd3735f3b558e425d367fa62b578e14bbb9da18c6458f4735bed1d46e40d3222e888e93
-
Filesize
938B
MD5596efc00ea4325ff6b4ab2347a5956ec
SHA165cd651905b293b692ef87a30b0a8235608078ce
SHA256c2e26e0caae647d3c482ee241841ce423be2e462d70abf4b75bd7436457cf9ed
SHA512de9bd24915bb11921192fb7747f124397855a46a65b5f022d41321e836beec7128e095b1abf8201d2e01682e3b594f69907085eefa558f6f04f1e46e06759b90
-
Filesize
502B
MD58dc8d04a157db1d36f13a7afb1d23d6a
SHA133e3eeb445a807a5a8dc63fa93591d949a8a3019
SHA256865f585d3674929bd8dabb9e4f92243e4a8094b42fe4e70177e180a90a2ddf2e
SHA512e3739806f791ca5c78aa7bcfd81575e54f08372848c307eab76002da15a7ee7b74c450ca98c338d45597d11413c5ac0b073fe2942babec9073820e6379c2dd62
-
Filesize
520B
MD5a7f2b4a86071fa9a90f8bd06dba38853
SHA148a0e6d04a78963b6714e7aaec619eb55a002657
SHA25641b7472d26f9129357070c7f79be5b102bbdf9907dade48b0ab608ae255f23d1
SHA512d5fc91d6d9706b8cb947660164badb19adf2f363c660030ca09a76ba25bb95265a3e0fa0c6b3614a04f5b554b75bc8d4c4da9f676fe6a10af14dbe37f1fe4887
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB