Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-04-2024 00:15

General

  • Target

    895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe

  • Size

    23KB

  • MD5

    c205f3805f746a0398e5801e38f8c941

  • SHA1

    99be3c55080d12cc65c9ec493c667669cc5ab854

  • SHA256

    895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e

  • SHA512

    68aed5e3dadb254cabb07b16f2f05fd0bdc1af27478e8079b08cff0b9c2527987d72668ceed791f743ef7d8fc44449797767f5338ec4a2998d4ab4580f1c86cd

  • SSDEEP

    384:9+Aaw4UDLXxQ08jOW/QNij53BVk46vfiPe68tR6HjTiLx4rwYRJ:wAabUxy2Ni1BG46vfiPUt4niyUYf

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe
    "C:\Users\Admin\AppData\Local\Temp\895c97808639685e11a80f3d0518d6b2c205a7cab255c169b15cb28f216e029e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\zmvmo.exe
      "C:\Users\Admin\AppData\Local\Temp\zmvmo.exe"
      2⤵
      • Executes dropped EXE
      PID:1980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\zmvmo.exe

    Filesize

    24KB

    MD5

    dc82e79dcb2862a0ae3d8dbf8f42e55e

    SHA1

    bc8e1c46d542f4111b521a3bb1e560112afa8417

    SHA256

    e916364edeeb6541c15ead53caced9368ed081aba0e18e397456bb8b9bc9decf

    SHA512

    925996796bc365bbe6a8f31619da468c158ead58dd2726194adbb872804e7b93ff1c7aab0bc75a3b88b90d6eb3e3d33da552dc510e8c36d9cef98f59b640350e

  • memory/1652-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1652-2-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1980-9-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB