Analysis
-
max time kernel
31s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
23/04/2024, 16:28
General
-
Target
ExInject V4.exe
-
Size
40.4MB
-
MD5
b5376b0ac908c1ff23f00ba4b4823f87
-
SHA1
89f270e1404a76594b0780d70a7ab9491b1e0de3
-
SHA256
6957aa3b521d1ddcc4a512e2fe7aa93eabf58e9a53a4acd4866c4930a881de28
-
SHA512
49c1704611beec9469cb47c74fa285404afe33b442a2aa64dd0a4efdb5bc2cf523096d1fca9044f81d7e9ea8488f7ee8b9f3b7d015aee1bec4167bf69d555d40
-
SSDEEP
393216:zWvz+q3V1VUIC3L+9qz8GvD7fEU2IGY/Vt1Wom6:Sz+q37/O+9q4GL7fEvILpm6
Malware Config
Signatures
-
Loads dropped DLL 48 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExInject V4.exe"C:\Users\Admin\AppData\Local\Temp\ExInject V4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ExInject V4.exe"C:\Users\Admin\AppData\Local\Temp\ExInject V4.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD56c604891a4c1ee77eeb2f40a36c28d1a
SHA15b43c4d162f69987f44c0ecf3eaf6653242df9ee
SHA2568b93fbec6f87679764d202fb0aea30ff3239a2c56f7316713bc28ad28a9c702b
SHA512f3f5353e0183ec175567d125d4beebd2fe2832c479e94da4640a6af65bc177be92106cc5cbde1052a2b7aa34caa0e3f72f75192277a94e2e0ba10a51daa33203
-
Filesize
10KB
MD5b9cd9ed29ef230a681204e620f246736
SHA1d32f47026b930543112f7c66a86f67f8ff5037d6
SHA25648f0d2271948aeb6b9298af7ac3a549940e2a73285d7e292b5437d9991e488b7
SHA512582bee1b5ce43d9d0c521c58795059fda89631e926f012a56e0ccc9ea8191c2371c5425a806acab3728403a3ed7fdf604597f28a024e8f4e285f8c2d97376839
-
Filesize
11KB
MD54edf450ba9e7ed3d8ab90b59264e33da
SHA16ba7686aae696fc733ee48b56eb9fd8bc5c19801
SHA256752d2370f2841b3a0a07dd6ab4d4ea2138ff7ec6283aa7ab51c4f796701c6787
SHA5120f22b50c5a1163c3ae0e40bfd6befe007dd893c3276207cb0f3b773c81618a3b5a9419676fefdab81f637dc33ac5c9c8adb2965530eac5c57d7f8ee270d4d975
-
Filesize
9KB
MD54efbbc5ff0543474cc27bc42307cc613
SHA15640fadcc6781b30b9de6e5b7255ebe563aeec2e
SHA256ff0c76c0da4c9e9264502789f75f6f75c9dd90ee981f53b19f1f5e9f45211663
SHA512b70801f9f578136f1b914e33b14e50496a43ecc70e8c73570a920efe84703cb6176ae9ec145269420efb3acd3a79c7f7c0cae27da5c5b9858e5d4739f09e7004
-
Filesize
10KB
MD5e57cb265746f2016e8556e0c842a5083
SHA122f4a2b87e8df403502bac3efab4f46385df2d7c
SHA256fb012e7903f96dcb5ebc22c076701c3bcca2ee7f930826dfebdd55b02e806525
SHA51248db6fd0715ed558836ed6e29b9042bc24d890d64343f8d8c65520dc7d8d462762f07c6514d5710967d8c6fa90d7d5ef73b4f631f65750cedadd2e1ef72b6275
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD57e668ab8a78bd0118b94978d154c85bc
SHA1dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA256e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
SHA51272bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
-
Filesize
37KB
MD5dec44ffe7b2922cc46f8930d7c27943d
SHA11deece09643b5759559310f1e29ebf2545d8ccb7
SHA256d8f3f8505a6ac7ad2b6268ddb44d6bb308b239f2e31dda7b850c49373550b21f
SHA512182652fb4f7afda921b1217d2a731c3c4ca802f46b2f050d73344addd980a110c61b34e63eec66a975f8d72551640d00dde39a525d9ecdeaabd3d8c4af75fe47
-
Filesize
48KB
MD585c70974fac8e621ed6e3e9a993fbd6f
SHA1f83974e64aa57d7d027b815e95ebd7c8e45530f1
SHA256610983bbcb8ee27963c17ead15e69ad76ec78fac64deb7345ca90d004034cdd6
SHA512142792750e4a5189dbeaa710e3f5b3689d593927ea77ded00eb5caada6b88d82a37459770845f1ea7c9f45da5a6ae70e19bfcf76d9f1a56184c3164b736bcb18
-
Filesize
71KB
MD526624b2ea2b9ec0e6ddec72f064c181a
SHA12658bae86a266def37cce09582874c2da5c8f6fa
SHA2569fcab2f71b7b58636a613043387128394e29fe6e0c7ed698abdc754ba35e6279
SHA512a5315700af222cdb343086fd4a4e8a4768050fdf36e1f8041770a131fc6f45fefe806291efc1cfb383f975e123d378a029d9884244a420523fc58b8178e8571f
-
Filesize
59KB
MD5e7ef30080c1785baf2f9bb8cf5afe1b2
SHA1b7d7d0e3b15de9b1e177b57fd476cecbdd4fcb79
SHA2562891382070373d5070cb8fd6676afc9f5eb4236251f8fc5c0941af0c53a2d31e
SHA512c2ec431d2821879bb505d8eca13fa3921db016e00b8674fa62b03f27dc5cee6dd0de16ba567d19d4b0af9a5cb34d544383a68cc63ff2fa9d8bb55e356d0d73e6
-
Filesize
105KB
MD53923e27b9378da500039e996222ffee6
SHA1a9280559a71abf390348e1b6a0fb1f2409649189
SHA2560275b03041f966e587d1c4c50266c3fdff1e1a65f652ad07b59cb85845b5457e
SHA512051c613403fd80b9582dd48c1f38870cb26846d54b75603ea52a78202a72272107e95750de78cd8f6c56951ebde501b4892d90fb306326b86124c8cc97bca594
-
Filesize
35KB
MD5c8b153f0be8569ce2c2de3d55952d9c7
SHA10861d6dcd9b28abb8b69048caf3c073e94f87fdc
SHA256af9f39d2a5d762214f6de2c8fec0a5bc6be0b8223ef47164caa4c6e3d6437a58
SHA51281ccbfff0f4cdd1502af9d73928b940098b9acc58b19c1a939ecdf17418096294af4a4529ee7a0bbe1c686e3b0254651e211c1093264d1835065a82711ac0379
-
Filesize
85KB
MD5bc2ebd2a95619ab14a16944b0ab8bde5
SHA1c31ba45b911a2664fc622bb253374ab7512fc35a
SHA256aeb3fd8b855b35204b5088c7a1591cc1ca78fffe707d70e41d99564b6cb617c6
SHA51286a6685efec72860991c0f0fa50f46a208211d3f8fc44012b12437d141c5f1a24c34a366f164d225869680707b482ab27a2720c698ebe8026f1c5807e81f8437
-
Filesize
27KB
MD5a0d009556def6620998b32b1c00e30e9
SHA15ecb08222c5b4690f946623a26084e3eecd2a52a
SHA256779daf36e38b9463d1158da62ccbde7e7210d78cbdf2ac3861f4435974f7889d
SHA51285a888aa5a104d016e67818dbab8587140549c1374ec4df7aba6758c3306e0c5d3225ea13f8b83850e1d74a3580ab5a1a6bbdf7df7bedb545f7cb526f3206d23
-
Filesize
33KB
MD5f14f9b9ffcd3ea9a5d1bcadc57e5095b
SHA14ff618d07f30efbc42b6fd2d7adcdb7d6409c966
SHA256b52e73ccd4164594414ee57e4e7d9d8337d2260b47bef9a0547db1ae482d917c
SHA51269b292040a8319b32e7849b487227de9d3fa915fb08fee72c1691a46036b6c9adac15c4049db25cd49d22f4df08faa7e5926f264d23493de6157bf47a335ce39
-
Filesize
26KB
MD5fcbb24550f59068a37ea09a490923c8a
SHA11e51d9c156354e00909c9f016ddb392a832f8078
SHA256de2ac6d99234a28dcf583d90dca7256de986fca9e896c9aafd1f18bb536978b8
SHA51262474bf9d5f39591240f71fd9270fcc7a2b2c0b4a1f93cbb57021040ad85b3ab8c401d17aedf0141105118772f453c6137a026736f069cc7a965cb30e5479f07
-
Filesize
44KB
MD5f6d0876b14bca5a264ec231895d80072
SHA1d68b662cfc247c07851ef0764fe9652e3e2c0981
SHA256bcbf9a952473e53f130ce77b0db69fe08c5845ce10dbe8c320b40f171a15d6a8
SHA5121db02975634ffcc4e73fac355d7f67a915c3b4189feaf9e7b24ef831e9f4a2e60a4bd1ebfd8157282a4094814332d62957fcd204b20f2904527e203ab355ab8e
-
Filesize
57KB
MD50fdedcb9b3a45152239ca4b1aea4b211
SHA11ccff1f5e7b27c4156a231ad7a03bcc9695c5b92
SHA2560fc03d25467850181c0fc4f0f8919c8c47cba2bf578698d4354aa84fd810c7f7
SHA5128ce5b38ee64ac0cda831b6b2c746fb95baadda83665d8e125eaa8b4a07cb61b3ef88d60741b978b2108ec08b067f1c9c934099f539b1e24f55e3ca8350359611
-
Filesize
65KB
MD553996068ae9cf68619da8cb142410d5e
SHA19eb7465d6f22ab03dac04cfce668811a87e198f2
SHA256cbd320c42277086cd962fd0b25842904ceb436346d380319625f54363f031dcf
SHA512d5fbc53a2fffecb1f3da4b126e306961de3b8070b5f722b6ed5e20bef6af48d52edf96c975f68278e337bc78a25b4227e9eb44b51baa786365a67cf977e4643e
-
Filesize
24KB
MD53c8737723a903b08d5d718336900fd8c
SHA12ad2d0d50f6b52291e59503222b665b1823b0838
SHA256bb418e91e543c998d11f9e65fd2a4899b09407ff386e059a88fe2a16aed2556b
SHA5121d974ec1c96e884f30f4925cc9a03fb5af78687a267dec0d1582b5d7561d251fb733cf733e0cc00faee86f0fef6f73d36a348f3461c6d34b0238a75f69320d10
-
Filesize
28KB
MD56b20122fd1f6e011e9fb4b3cb105151c
SHA1721c6a7fe92c2a98e18e90eb16c8f296c5208504
SHA256ce3e86869dd5f35bc9cdb1f3eb03b1d0cdb32e0a01edcf8f45e8052a452df46a
SHA5124a663379f3b0ab3fc34662215308ba23637b88129c6d778b7e6ef3cbf9853f71c4f30a92f84c2ebed40a380117f81569ed7bd6c059da1b6df013506c5221fbc0
-
Filesize
1.3MB
MD53909f1a45b16c6c6ef797032de7e3b61
SHA15a243f6c8db11bf401aeac69f4c2a0c6cd63b3a8
SHA25656cce68da6a7ebd11aab4b4a4e6a164647b42b29ae57656532c530d1e22e5b44
SHA512647e343eb9732150c0fd12c7142a960ede969b41d5a567940e89636f021f0c0b3249b6cfc99c732190085bcae7aa077f8ac52c8e7fe7817d48a34489f0cd5148
-
Filesize
9KB
MD5ea68b13d83a5c7521453120dd7bd4dfc
SHA1182d77f89ceb44b524b9d53d6480343f9670fc9c
SHA256c3d31f8842c002085e2d7aa43856c2297d6740f70450c2c4bf80dc1d8360cbc7
SHA51241d3eddc57ee9c643ab28a6e0286cd39c2724a9d1bdf24d75d1dd3ec7900396768e6afa4702272b051627855bdcb12fac8d8834d1d1ddf1638c769c89c2b488d
-
Filesize
39KB
MD54b81e1518d8fc26804b26fa0099ee5b6
SHA1b152ee2d7b843b883f830e69af629a49e2909dcf
SHA256f00565d8909029ce00bc04048a551975db20eb8aa39d1e4a65b7e659c0945100
SHA51209ad69911959418e458cf25c972b4d14983d58c4a48ae739c31d981125442673e66d935bf9c2ea0aa8fbfa20ba4434cf9aac6e6a3b0bd776cf4e46cb80b93949
-
Filesize
1.6MB
MD527515b5bb912701abb4dfad186b1da1f
SHA13fcc7e9c909b8d46a2566fb3b1405a1c1e54d411
SHA256fe80bd2568f8628032921fe7107bd611257ff64c679c6386ef24ba25271b348a
SHA512087dfdede2a2e6edb3131f4fde2c4df25161bee9578247ce5ec2bce03e17834898eb8d18d1c694e4a8c5554ad41392d957e750239d3684a51a19993d3f32613c
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD56eda5a055b164e5e798429dcd94f5b88
SHA12c5494379d1efe6b0a101801e09f10a7cb82dbe9
SHA256377da6175c8a3815d164561350ae1df22e024bc84c55ae5d2583b51dfd0a19a8
SHA51274283b4051751f9e4fd0f4b92ca4b953226c155fe4730d737d7ce41a563d6f212da770e96506d1713d8327d6fef94bae4528336ebcfb07e779de0e0f0cb31f2e
-
Filesize
31KB
MD5e9aa5140b00ebf379f0fbb074da1a60c
SHA1addab6d6254fe7cf6c92430f3320b622ba9d08bf
SHA25604a26c2621042f666753f32e2b7a3c70032c04c317cce20e71034623e8812834
SHA512bd4673ba1d5783504eba9100ac73e4832eed12f9d5a38ca7680e16cdb63100af702002369a2e7de551dfff30f14d3bbaa64b50eec657a6cb1b63b11dbf062138
-
Filesize
88KB
MD5f9e13d07ede0af5cd9ae01c43c25c1b2
SHA19526cfa305a316e311bd340b1aeef5ab19699839
SHA256b1da90109b501b680b89878f3952988d1b1c7e367cb2a1d23e3424f33462c62a
SHA512917c9377936c32fd3292091b6d005e31b61cc3be41ca3658c9a0232d392d877c398cb7993400d26bc7355bf03319c60f4572012a2fd5c4074f05bc4987a43839
-
Filesize
66KB
MD577896345d4e1c406eeff011f7a920873
SHA1ee8cdd531418cfd05c1a6792382d895ac347216f
SHA2561e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
SHA5123e98b1b605d70244b42a13a219f9e124944da199a88ad4302308c801685b0c45a037a76ded319d08dbf55639591404665befe2091f0f4206a9472fee58d55c22
-
Filesize
1.7MB
MD586d9b8b15b0340d6ec235e980c05c3be
SHA1a03bdd45215a0381dcb3b22408dbc1f564661c73
SHA25612dbbcd67015d6cdb680752184107b7deb84e906b0e8e860385f85d33858a5f6
SHA512d360cc3f00d90fd04cbba09d879e2826968df0c1fdc44890c60b8450fe028c3e767450c3543c62d4f284fb7e004a9a33c52538c2279221ee6cbdb1a9485f88b2
-
Filesize
25KB
MD5cce3e60ec05c80f5f5ee014bc933554c
SHA1468d2757b201d6259034215cfd912e8e883f4b9e
SHA25684a81cca6d80edd9ec2d31926231de393ed7f26ed86ae39219adc5eab24b8100
SHA5127cbcee4dd4c817fbef8b9aef2d457b56970c5e5c03bdf2caf74415316b44e7da33ee39b6a434f4760c80f74c33b5c0c5ad00936d438b947a39ffcd53e890cf0c
-
Filesize
622KB
MD5c6ed91b8fdb99eba4c099eb6d0eea5d9
SHA1915b2d004f3f07cd18610e413b087568258da866
SHA256e6e1910e237ac7847748918804d1c414c0f1696a29e9718739312a233eb96d80
SHA51292fe738fcd75e39c6bc9f1edb3b16a1a7cf3ae6c0d2c29c721b1a5bd3e07a4bb8e8295b3ad3cb44bcee05a8110855b0fea66b156461c4f1761c53c15d7e67ee5
-
Filesize
295KB
MD5427668e55e99222b3f031b46fb888f3a
SHA1c9be630cb2536c20bbc6fc9ba4a57889cdb684bc
SHA2569ca1b01048d3867cb002a01a148f279ba9edaf7b7ad04d17e3e911e445f2d831
SHA512e5ca0ddc2758891090db726de2d3fd7f2ba64e309979136b4d3299445b1f751dfd8cd56bb3343499cb6ed479c08732d1d349d32b7f7e5ac417352bd0ce676253
-
Filesize
1.1MB
-
Filesize
48KB
-
Filesize
6.8MB
-
Filesize
148KB
-
Filesize
52KB
-
Filesize
204KB
-
Filesize
820KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
84KB
-
Filesize
208KB
-
Filesize
5.1MB
-
Filesize
52KB
-
Filesize
96KB
-
Filesize
1.5MB
-
Filesize
52KB
-
Filesize
144KB
-
Filesize
52KB
-
Filesize
44KB
-
Filesize
5.1MB
-
Filesize
156KB
-
Filesize
204KB
-
Filesize
180KB
-
Filesize
84KB
-
Filesize
820KB
-
Filesize
100KB
-
Filesize
60KB
-
Filesize
44KB
-
Filesize
148KB
-
Filesize
6.8MB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
44KB
-
Filesize
88KB
-
Filesize
44KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
100KB
-
Filesize
2.5MB
-
Filesize
164KB
-
Filesize
144KB
-
Filesize
184KB
-
Filesize
6.8MB
-
Filesize
148KB
-
Filesize
60KB
-
Filesize
100KB
-
Filesize
180KB
-
Filesize
84KB
-
Filesize
5.1MB
-
Filesize
100KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
204KB
-
Filesize
820KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
208KB
-
Filesize
1.5MB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
156KB
-
Filesize
44KB
-
Filesize
96KB
-
Filesize
144KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
52KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
2.5MB
-
Filesize
164KB
-
Filesize
184KB