1cb6977c6c4553ff7842af9205760e5c5958a85ffb3db2c1e94c69fcd0f0a347 | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 08:42

Sharing

Report Analysis Logs

General

Target

$TEMP/xcmd.exe
Size

32KB
MD5

378e0103156f2e6844c83087d80a7156
SHA1

c3e577e294ee81cd763625b4f6657795c4a8a6c4
SHA256

82fbc8842aceeb471967d2e78b7336c972e3d1379fcd23662df022af958f40c1
SHA512

0d9e162042f0894aeefb4d43a2c98161686b4451605cbaddcf12f367b17ed1a3796370e770dfbbe6b2ce7ddfba7dc42747ce564b8f80c292b331a600910103bb
SSDEEP

768:vGw9ERxPw5DAKshWRjzrjBav9+IZ5deSbA:vGQc4TsYznBA9LISbA

Score

9^/10

upx

Malware Config

Signatures

Nirsoft 1 IoCs

Processes:

resource	yara_rule
behavioral22/memory/1776-1-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral22/memory/1776-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral22/memory/1776-1-0x0000000000400000-0x0000000000416000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\$TEMP\xcmd.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\xcmd.exe"
1⤵
PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1776-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download