Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-02-2024 08:36
General
-
Target
0d4e462fee946196047d417a459f989b579605bf088f7c5137f4b7a2bd31e67d.exe
-
Size
536KB
-
MD5
4c1a2a6180829d55a40d6d1fdc481c3b
-
SHA1
dcbdec7ca01efe9534233a4bda6843d483aa5882
-
SHA256
0d4e462fee946196047d417a459f989b579605bf088f7c5137f4b7a2bd31e67d
-
SHA512
f122fa7c2bad3301f7d5e87858dbdd29a37308a52359d45a2acc58394849786b2bde3b16085081d28509fb17d855651bd2c83e8e71d4b407edfafe0e77e7cc9c
-
SSDEEP
12288:Yhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:YdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\0d4e462fee946196047d417a459f989b579605bf088f7c5137f4b7a2bd31e67d.exe"C:\Users\Admin\AppData\Local\Temp\0d4e462fee946196047d417a459f989b579605bf088f7c5137f4b7a2bd31e67d.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a10d82f0bb8bfbff173166cbfe2c513d
SHA1f52262c0f908c99b12a06751a7b9091279a614d9
SHA2567873d9a1040c099133674b95df091c25a71bba7cb29bab261ab62866394dd00b
SHA5129694b1027fd3218eece3d90887c0c23efe141c1e8c97f8ef629eab1307dc162e8fff354aac6e3b85729890df8e9672facbb310eb9fe1f5440d74d69cfa3619e4
-
Filesize
939B
MD5e227726d814fcab468352c0b58b1c71d
SHA1cddeee10272e9cd07330f86c17fc58c17762f051
SHA256387234a4242d7d74146f3880e1e2d7ed38519f2d3e1536a4654f2970b6de881f
SHA51212b89823a557dc16004a9093065d2dcbe11637951c1c0a978d6db45088e6f2cbefa52ba236fb27dd7d0435bc1baf5fdc0cc488e0d53c7558230d08d19f48f9ec
-
Filesize
502B
MD569bef74c58a7b64392449431c857f829
SHA13ef166f866d76a4c5e18f6078266f892addc7f42
SHA256572824547ad8f8786666b18595852c1248bb5cf4e61c1d0e1a45040a3ed258ef
SHA5120cbe9f15f8ee0baa73cd479b54202fcf13f4dab19ee034abdf8a7306044b8c45c23cb98a95f5cce2c496c0c399811e0c4ad06117b1ac4b5895cb661e4925ac39
-
Filesize
520B
MD5ab9b800fda008d88face3480f525ea5d
SHA1803c48340285510bc76973ff15da7280697eea1d
SHA2562a0690ec40150ae8b1790608d0b708cfd95286aac855340c123152abffd0e835
SHA512f9d1a1445219e5129fb9a8f67c5c5a6cc68a7df6b685ac482e8d96a4978158bf66863e0da2b5e188039d6beb70f67e3ef02c73b88b666806f676d40a2464dd35
-
Filesize
4KB
MD55d8061ce09ac3097dfcb8918ee13c43c
SHA1a4d8cd77eea0159df25db972ace2aa2fbae18afd
SHA256be14020ec64219cf05d475321693fc929a9a8564796f1971e508a0ab70a51a54
SHA5124bbabfdcd9df48d610a9c48660b25b04b0247c470b40f38de3e8712a032702f1cef433078dca347cbdb2312fd380bfa2506d318b85604f4aa20c20661b1f86d2
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB