Resubmissions
09-04-2024 13:37
240409-qwz1tsbf5w 709-04-2024 13:37
240409-qwzp3abf5v 709-04-2024 13:37
240409-qwy4jabf5t 909-04-2024 13:37
240409-qwyg1abf4z 805-03-2024 02:32
240305-c1nlpsch53 9Analysis
-
max time kernel
306s -
max time network
1201s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
14-04-2024 10:34
General
-
Target
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
-
Size
1.8MB
-
MD5
f41c9e6ca239395e71bcf027987282dc
-
SHA1
560a973e308f20e0dbe64a38eaeaa22285ced049
-
SHA256
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b
-
SHA512
cbf99c0e43b3a314ee6681f8655a269c0d51e4d40c10ea9c8571be30c5d69c0287c57be5b13e4fa7aecad7095efb4a741f1839dc9089251f41fa96f35011764a
-
SSDEEP
24576:h7OEqlRKCYqoxOMto8enhtiQkbx6zWXXfKfzZn00Eze2aP4sjagjotkEz4RaZMjM:h7B50L7fiQ26zEXfId0vFaQgMh4pj
Malware Config
Signatures
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD59b2986911dd53fdda3a049f80e2fe4c8
SHA12e9e3f7bd2ed141fcedfd8c9caa787b04a96db67
SHA2561baf86a01a45e998d4e94c0c85c8bd5a7058693fe4587e2ada13eebec809ff2d
SHA51245e8cb3eeff3b2b2d3f0dd5f124fdf660698ccba9a346bcc502b7672bc65ca30f0fa507a4b69eb1dda7fe9b033b9abb1ea4a6d914c8b7b395a6220cf21af9187
-
Filesize
8.8MB
MD5b379b657f344816cb8119187f8faf151
SHA15913f24492e424f04a5a4f89d8bafad89632a2f0
SHA256ff010938d049de9907b3ae0c8b2a861071a2c26a205afd491da1cf81f46378b8
SHA512dd22a436f45e8663ac24aa6608c70adaaddfd85e11be0ca064f0335038627ac985dbd6fef76670bca1539ca49542d1dc1a2454a2f8599d20ef44c851d4833b23
-
Filesize
1.8MB
-
Filesize
1.7MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB