Resubmissions
09-04-2024 13:37
240409-qwz1tsbf5w 709-04-2024 13:37
240409-qwzp3abf5v 709-04-2024 13:37
240409-qwy4jabf5t 909-04-2024 13:37
240409-qwyg1abf4z 805-03-2024 02:32
240305-c1nlpsch53 9Analysis
-
max time kernel
306s -
max time network
1201s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
14-04-2024 10:34
General
-
Target
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe
-
Size
1.8MB
-
MD5
f41c9e6ca239395e71bcf027987282dc
-
SHA1
560a973e308f20e0dbe64a38eaeaa22285ced049
-
SHA256
92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b
-
SHA512
cbf99c0e43b3a314ee6681f8655a269c0d51e4d40c10ea9c8571be30c5d69c0287c57be5b13e4fa7aecad7095efb4a741f1839dc9089251f41fa96f35011764a
-
SSDEEP
24576:h7OEqlRKCYqoxOMto8enhtiQkbx6zWXXfKfzZn00Eze2aP4sjagjotkEz4RaZMjM:h7B50L7fiQ26zEXfId0vFaQgMh4pj
Malware Config
Signatures
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"C:\Users\Admin\AppData\Local\Temp\92eb323e0240228429277748079975b5626bed0bf249ec53e7fa78c88ede0c5b.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmpFilesize
2.7MB
MD59b2986911dd53fdda3a049f80e2fe4c8
SHA12e9e3f7bd2ed141fcedfd8c9caa787b04a96db67
SHA2561baf86a01a45e998d4e94c0c85c8bd5a7058693fe4587e2ada13eebec809ff2d
SHA51245e8cb3eeff3b2b2d3f0dd5f124fdf660698ccba9a346bcc502b7672bc65ca30f0fa507a4b69eb1dda7fe9b033b9abb1ea4a6d914c8b7b395a6220cf21af9187
-
C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.newFilesize
8.8MB
MD5b379b657f344816cb8119187f8faf151
SHA15913f24492e424f04a5a4f89d8bafad89632a2f0
SHA256ff010938d049de9907b3ae0c8b2a861071a2c26a205afd491da1cf81f46378b8
SHA512dd22a436f45e8663ac24aa6608c70adaaddfd85e11be0ca064f0335038627ac985dbd6fef76670bca1539ca49542d1dc1a2454a2f8599d20ef44c851d4833b23
-
memory/3844-1-0x0000000003E90000-0x0000000004058000-memory.dmpFilesize
1.8MB
-
memory/3844-2-0x0000000004060000-0x0000000004217000-memory.dmpFilesize
1.7MB
-
memory/5000-3-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-4-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-5-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-6-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-7-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-8-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-13-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-14-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-15-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-16-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-17-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-33-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-45-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-46-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-53-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-54-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-55-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-56-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-57-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-61-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-64-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-60-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-63-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-72-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-71-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-66-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-69-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-68-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-65-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-62-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-58-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-78-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-81-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-84-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-93-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-104-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-92-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-90-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-99-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-89-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-98-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-88-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-96-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-87-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-83-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-91-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-82-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-80-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-86-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-79-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-76-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-74-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB
-
memory/5000-73-0x0000000000400000-0x0000000000848000-memory.dmpFilesize
4.3MB