Analysis
- max time kernel
122s - max time network
122s - platform
windows7_x64 - resource
win7-20240215-en - resource tags
- submitted
29/04/2024, 03:14
General
- Target e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe
- Size 130KB
- Sample240429-drbq8agg5x
- SHA256 e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18
Malware Config
Signatures
- UPX dump on OEP (original entry point) 8 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe"C:\Users\Admin\AppData\Local\Temp\e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe"C:\Users\Admin\AppData\Local\Temp\e2c55fe1fa14508206c5d8d051e96471f83e299bccabe23d972780e534a5ca18.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NMGPX.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v ".Flasfh" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe" /f4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"C:\Users\Admin\AppData\Roaming\..Flash\Flaseher.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
NMGPX.bat
Flaseher.exe
memory/2460-158809-0x0000000001F30000-0x0000000001F31000-memory.dmp
memory/2460-3-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2460-21-0x00000000002E0000-0x00000000002E1000-memory.dmp
memory/2460-41-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/2460-51-0x0000000000530000-0x0000000000531000-memory.dmp
memory/2460-53-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2460-696-0x0000000001F30000-0x0000000001F31000-memory.dmp
memory/2460-695-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2460-0-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2460-11-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/2460-798807-0x0000000000400000-0x0000000000423000-memory.dmp
memory/2460-9-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/89936-798805-0x0000000000400000-0x000000000040B000-memory.dmp
memory/89936-798851-0x0000000003350000-0x0000000003373000-memory.dmp
memory/89936-798850-0x0000000003350000-0x0000000003373000-memory.dmp
memory/89936-798849-0x0000000003350000-0x0000000003373000-memory.dmp
memory/89936-798845-0x0000000003350000-0x0000000003373000-memory.dmp
memory/89936-798839-0x0000000003350000-0x0000000003373000-memory.dmp
memory/247556-798853-0x0000000000400000-0x0000000000423000-memory.dmp