Analysis
-
max time kernel
164s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05/03/2024, 23:23
General
-
Target
b5ea83a28f0548db57c3b813573dab45.exe
-
Size
451KB
-
MD5
b5ea83a28f0548db57c3b813573dab45
-
SHA1
5df03970701d8d7b38e6305b708316bf7b340733
-
SHA256
9b29e48ed124a19195ce0aaf198f5d14f71429594fca583eca811d682a47258d
-
SHA512
f1e4c330d4ef0d8b4f8facb9e0aa2caa232639a098c70fd75c43094fc0e881d8afa58e54008be23b82a51609817ead8875402b9d3f1ec12b52cc873c1883c8d0
-
SSDEEP
12288:xK/sVCBV5yJnFbrCiXlrmPmOay0TiBlV:x2sAXyJFtdmuny77
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ea83a28f0548db57c3b813573dab45.exe"C:\Users\Admin\AppData\Local\Temp\b5ea83a28f0548db57c3b813573dab45.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\eO06509MmPhE06509\eO06509MmPhE06509.exe"C:\ProgramData\eO06509MmPhE06509\eO06509MmPhE06509.exe" "C:\Users\Admin\AppData\Local\Temp\b5ea83a28f0548db57c3b813573dab45.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5f14c6f62c9488f8b7543516e1dc7f9d2
SHA106dcb54c87732888c84cddc4523f9639428eba2a
SHA25650773f41f22a4fea283ce938e0796103a1771b1ff13ac8edbc49af727d6e434d
SHA5124268ccc2098a2e231a1096d86d22a13b8fb4bd70e38789a9a19f817e5c206c8a6c66db881cd97d721b707aa621bfe41b14cc06d9bf4e0a722c2ef9ba15ef66c0
-
Filesize
451KB
MD59b438de360023f7b2e596322b0b1bf6c
SHA1a9517456ab9238d0277c0bc8fcb2e970cac9632b
SHA25692f487763460903da7c01d36bbf7d4f40a141705f0f595b8f667c170a9d631f7
SHA51254e972e3c9798eb6926aee8b4e003ae18882284e74d70d5b12043680294ecd1d6fcc1db098da17a3bb6ad2a4ccb168afd8738a0c82f93bb02b4127ed182d01b7
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
776KB