Resubmissions
26/04/2024, 07:25
240426-h847babf2x 826/04/2024, 07:25
240426-h84wjsbf2w 1026/04/2024, 07:25
240426-h815nabf2s 826/04/2024, 07:25
240426-h81h5abe91 1026/04/2024, 07:25
240426-h8za3abe9x 725/04/2024, 13:12
240425-qfq3zsba6t 8Analysis
-
max time kernel
264s -
max time network
305s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25/04/2024, 13:12
General
-
Target
c4f00ad34b1347583b292acacbca0ee00e9dd594519e26f22da895ecf6002b9a.exe
-
Size
1.9MB
-
MD5
15184ed11b2354eda1f1787dcbbcf04a
-
SHA1
f21cfdfdb3d6be8054cd9b5f21ac39ef2ec28011
-
SHA256
c4f00ad34b1347583b292acacbca0ee00e9dd594519e26f22da895ecf6002b9a
-
SHA512
1fa8bfb44652654cb0fc72c793ddd4431a1ee293b326fae7d4095bde00cd4717cd5cdcffaaba8cdccb43e5bceae19574661caca4e8011b0d22c67ab34ce761ab
-
SSDEEP
49152:S3fAWuVHSdrO+tzwZHkr+8d3OCWwhdGshy5N7gQwgY9P:S3fAWubyzn7+3whNw7wg
Malware Config
Signatures
-
Contacts a large (732) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f00ad34b1347583b292acacbca0ee00e9dd594519e26f22da895ecf6002b9a.exe"C:\Users\Admin\AppData\Local\Temp\c4f00ad34b1347583b292acacbca0ee00e9dd594519e26f22da895ecf6002b9a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4f00ad34b1347583b292acacbca0ee00e9dd594519e26f22da895ecf6002b9a.exe"C:\Users\Admin\AppData\Local\Temp\c4f00ad34b1347583b292acacbca0ee00e9dd594519e26f22da895ecf6002b9a.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD52980d648c78c4022d9424561f0995f00
SHA188b745a69b46a1a67cf43e759fbfe510af85dec5
SHA256a69c5e427c091b1b429339c58b4ddb78c917cc719dc0401dd45361d716d1e29b
SHA5121eec6a28547d1adf4564646dca7a19d8b6a503c0506f015b53a640a6edf17b12290ee128b60072cf0d86cd20c16798e724746a1771432b20255b9e3ad05c2e6b
-
Filesize
6.9MB
MD5eb06040a9975ba542d8027c9961f5ba7
SHA1a1b80718a073cc3fb7f66503834504a01be63bb6
SHA256fc79e4d0b0bc3aeaf8225bf7607649f323868b520ecd51fe1992b43ab8369189
SHA5128c09267c32dbe26e7cd7c3a7bc17b0b9a105480bc77dd3773febb00d8450b7bcaa8dba7185c1c40e10848f006b35cb6bf66e1a7ed28d47d77135687b49531e85
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB