Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-01-2024 15:44
General
-
Target
6801b835572c1736b2aeb6e55b7c88c6.exe
-
Size
54KB
-
MD5
6801b835572c1736b2aeb6e55b7c88c6
-
SHA1
9ff46580d7d9258f8c10766c288ad355ea4398bc
-
SHA256
3e24b23721c3655a5148eaf5ff23e398730e9f270307d14d5452f165732a5054
-
SHA512
152b4bcf5b8f4a72a76dbda2c997e38a58827a8edb9e031e750b8d2d2553a600d3b00091cbf37af1b27b3222fa7a68e971b5d6829c06d5167cc95da1aa47d807
-
SSDEEP
1536:6vQqZwQUxtwILj8zMs/jtI7iG43yf6KpVi:6xwhxZLwzM1YyfRVi
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6801b835572c1736b2aeb6e55b7c88c6.exe"C:\Users\Admin\AppData\Local\Temp\6801b835572c1736b2aeb6e55b7c88c6.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SVCH0ST.exeC:\Windows\SVCH0ST.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD56801b835572c1736b2aeb6e55b7c88c6
SHA19ff46580d7d9258f8c10766c288ad355ea4398bc
SHA2563e24b23721c3655a5148eaf5ff23e398730e9f270307d14d5452f165732a5054
SHA512152b4bcf5b8f4a72a76dbda2c997e38a58827a8edb9e031e750b8d2d2553a600d3b00091cbf37af1b27b3222fa7a68e971b5d6829c06d5167cc95da1aa47d807
-
Filesize
23KB
MD5ae731297b509d6fbdacb1928e486d922
SHA1e5802e534a3545857380843c53ab825f4b1b3fee
SHA2568e4449416908c8534511ab689ace1085491c4771fe81003856a5a50f6a51fab5
SHA5121ce9208adb32e5c08600e3dd82827351d2e26fbdbea9eda97373c11023f462208dcf84439a04c4101ad25cde6fbca8a8a26ec9177a135362e037fcad9dc48dfc
-
Filesize
20KB
MD5d1a192350cff8cf330946dee8d633b2d
SHA17d6a4f11603b8e7189285900b5ad208ac4243798
SHA256ca090e9354ca8f5e07055d65b0c42912bf938a29fb0e0f922594eb5a55ec48c4
SHA512bfab16512e2ff0e370f42085c2c5837d51f0aba6db1323ebbe562d4b0208c261ba90e26e2cad9de92ae35cf302e86fa14270f38bd72ddbc879385681efb8f05f
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
92KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
