e99121de906a1fb921f1f4388fcffd3424000340a49d5d4f45f3aa912f1eeb55

Analysis

max time kernel
5s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Unwanted-Program.00578aef1.32765.4895.exe
Size

17.3MB
MD5

f429810f03b2e5472f51f22dbbf6f165
SHA1

361572f7729f71af2d77c2db0d352d6eb3b11cda
SHA256

e99121de906a1fb921f1f4388fcffd3424000340a49d5d4f45f3aa912f1eeb55
SHA512

7453bc834416b652ac93315c3c86cec371f2a042bdbd368514ef38f5337c9d2e99ecdd4baf94ec40d71b0fece5dfc6e611e1424f7caa61f823c64dd787525b92
SSDEEP

393216:BMlU2nBTLv7A1J9mA0Z8h6B3LhmNm4S0JWeG7PX:ByU2nBTLv7A1OAO7B3FcfSX

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1900-0-0x0000000000400000-0x00000000029C9000-memory.dmp	upx
behavioral2/memory/1900-66-0x0000000000400000-0x00000000029C9000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Unwanted-Program.00578aef1.32765.4895.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Unwanted-Program.00578aef1.32765.4895.exe"
1⤵
PID:1900
- C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rfusclient.exe
  "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rfusclient.exe" -run_agent
  2⤵
  PID:4152
- - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rutserv.exe
    "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rutserv.exe" -run_agent
    3⤵
    PID:772
  - - C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rutserv.exe
      "C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rutserv.exe" -run_agent -second
      4⤵
      PID:4460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\EULA.rtf

Filesize
15KB

MD5
9b0e600eb09e7a86199f7ba245d1cd2b

SHA1
e3e52b3e04b08e59aae74300f7d30c3d0aa27148

SHA256
879180116b82210292648709982f405eae84b05e6f2ff324a6a5cc7cd512d3e7

SHA512
dd1622474c48ecf5c95e7585fb30b5279cf45dfc89332531758838b05f73499f536f7cadaf529aa4fa5ae0808e30a455465829db7d13f2ee2e7d9b7bd12e17e5

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\eventmsg.dll

Filesize
52KB

MD5
b2e6147f97dae696265a089f98ce8106

SHA1
418f20ec486b7a9368ceff183e7cebae9ba52101

SHA256
44917b2c260fea3a0f4691f6e986c25e31b3f9ff22dcd055526199b4d8a54051

SHA512
789dd02281b71fab54f42b92b5c0c76c0266c40100dbe532ad3ebbf968e8a9e674f0be57e2ffdb10eb4a6b4faa15a6a6a92907c020c6cd2990427d890d7f5026

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\libeay32.dll

Filesize
1.3MB

MD5
b0433711581916700978618558131929

SHA1
6513c7c14f19fa37c73926fc098a9da678621e04

SHA256
26b24dcd9cb7ab8761ae7fb597704f81e2a6ede6572a247c39a969960dbba539

SHA512
a1d8bcd4b641b5e54a4435a70e19a56ecce6dc9c7d9b6fc28f7829de96d139c9cfd10f35f096529f8d33583bea8ffe1b6c2636f2710d9d01f1a7513f77db8589

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rfusclient.exe

Filesize
10.4MB

MD5
6aae165f3b1575db887a0370cfc80083

SHA1
18bc72662b4366035932719ef131417aacf9c184

SHA256
0c89262a283c80121ba1176345b230d0ade61cfcf682b92e555a48206fb4074a

SHA512
666f1a5c6b0c7a5315d70eb0d75da6232105e5673b44f6137be4b10377b8d07c21720d05360cc653f543657478b08eee1d95db5fb1cb8d82d5c2a0f2ff68e7c7

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\rutserv.exe

Filesize
20.2MB

MD5
652c2a693b333504a3879460d0af7224

SHA1
235ba3847df3f39ad445b5b912cb2fb5224d9e59

SHA256
760e2fd3e57186b597d40b996811768e6c4a28ca54685e029104fcf82f68238d

SHA512
a717e916e9d881970694856f79f0e571b95c350f0b771027188dc9b27ab99c193149d4fe0e32cb4638c840340eb1dbd7fbf7458a58985a3e5be7da3345cd86c6

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\ssleay32.dll

Filesize
338KB

MD5
74f9696be4b46f04a1263c3181405c35

SHA1
cf66b349beaa2bc25ed5807763e32018e4304c7b

SHA256
d6e8bee1a9476ed3be229f4be81cc1154f1ed425e50e74fd1abcd76c56ea062c

SHA512
f122e00b795476809994733028346d82945566ce4c2be26444f02e077658ccb1ba0f3fe221cef37837941054fe4b3b54b3f9a74861f890e56544d1453823fd68

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\vp8decoder.dll

Filesize
380KB

MD5
c14000f68306f1cf0ec799df9568ae01

SHA1
788d8d7a0ba86ba6c7ef4f7ae50cdc65ddb348ff

SHA256
53b040341ce80f246c8437a99df5252a48801e2154eb94dc50af54a75d8d85ac

SHA512
2d4769949832794ce310474f843b696ea8eeb819554ecd72c449981988a6f8fbc5155d84a97d8a4c015348b3dfe6708f88c64b257d4a4d0d4a03dd068dda4113

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\vp8encoder.dll

Filesize
1.6MB

MD5
30448db0aac5ac16d7ad789011bf8d20

SHA1
457a43f6d2a0120c138dd9d57bcb64b21f84d9d7

SHA256
d781088435617ca1facf74c1304f82afcb388813a75c8cb32213541d35b21832

SHA512
300e3ae2ac133e2494c449354582ad9be51731d3e92d161b998db14262cc08436eeddb2b73a2f47cb4d1245348055f19e02721638a64a0630f513d4919b359dd

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\webmmux.dll

Filesize
260KB

MD5
5e8673834662ac42b8363e19bc719282

SHA1
bb1c1ed731830a03db47d232e748df4e4d196db9

SHA256
a64a113955ec0d89ae6ff357f9bb1063c7dd29fe5610ee516a94ac17b11172c2

SHA512
3cf558b2d3ca03aed1ef0cfe36fb7ff3fe7a3af63a4c3b0cb6cf13c58baacae17e5a01bad743affae8c4f5b9f5425dd4a97755aca2ded99e70d782f699a9e225

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\webmvorbisdecoder.dll

Filesize
365KB

MD5
95d30b282132fb591fd5fdd94e52af05

SHA1
eb7abe2f02c19ee41e4efc2506337288141d70ed

SHA256
e6c04dc8359b2c76f765fce37ec123d33acbc5ce93e60022ba88eb7c867ac3f6

SHA512
9e4ea23519d243d6d3ae93d2501f05f35aa1cc6264adb8f180f8a255bd35fb7996e110ac0ec7960fa0b93062be45eb0c0922d9597e76ee8180781cc5c9a9c792

Download Submit
C:\Users\Admin\AppData\Roaming\Remote Utilities Agent\70220\A2F2E8D838\webmvorbisencoder.dll

Filesize
860KB

MD5
a663e7ef3f3cd7a1d4790b4ebf491c27

SHA1
bfe086e653d0bc8d20acae61990ba4fa33f2a1f7

SHA256
8b1f95d7c0fdf25a6278347afda2f5ac4c86045c7fc530a330be885d8a87ea68

SHA512
e78460c287646f509a50b878a34392546e01803a46c389e942073013a8292e3653713f2b6067842ecccb09b7cdc13d1d9fff76065aa61910fc3cebe6a1c20c47

Download Submit
memory/772-85-0x0000000000990000-0x0000000001E80000-memory.dmp

Filesize
20.9MB

Download
memory/772-74-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/772-82-0x0000000000990000-0x0000000001E80000-memory.dmp

Filesize
20.9MB

Download
memory/772-79-0x0000000006650000-0x0000000006651000-memory.dmp

Filesize
4KB

Download
memory/772-80-0x00000000066A0000-0x00000000066A1000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/1900-66-0x0000000000400000-0x00000000029C9000-memory.dmp

Filesize
37.8MB

Download
memory/1900-0-0x0000000000400000-0x00000000029C9000-memory.dmp

Filesize
37.8MB

Download
memory/4152-73-0x0000000000310000-0x0000000000E2D000-memory.dmp

Filesize
11.1MB

Download
memory/4152-71-0x0000000000310000-0x0000000000E2D000-memory.dmp

Filesize
11.1MB

Download
memory/4152-68-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/4460-86-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/4460-93-0x0000000006E20000-0x0000000006E21000-memory.dmp

Filesize
4KB

Download
memory/4460-94-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download
memory/4460-95-0x0000000007580000-0x0000000007581000-memory.dmp

Filesize
4KB

Download
memory/4460-96-0x00000000072F0000-0x00000000072F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads