Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 21:46

General

  • Target

    VirusShare_58b20331447d0aceee52495c551e2f68.exe

  • Size

    81KB

  • MD5

    58b20331447d0aceee52495c551e2f68

  • SHA1

    d828813f3d6219a581fefdbc02f58f2c899bb719

  • SHA256

    89a19c4c4dc3b49ac730d515b3700e4b8f132836b9b9d316e87762487ab57dd7

  • SHA512

    b2327341cc3f45c894778aca6f0467d32635460cceff4c121c9fc4e1f4d55a3a703a805f414e3f2a1e9af20e3789af3897896df8c055b21bc30003e9b6f8eb0c

  • SSDEEP

    1536:DZc66tHVhu3M6nsFc4c/caNFy7Kgv4oCd4fxfekO:D4+ciQcj07KgfOY2kO

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe
      C:\Users\Admin\AppData\Local\Temp\VirusShare_58b20331447d0aceee52495c551e2f68.exe
      2⤵
        PID:2664

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2492-0-0x00000000006B0000-0x00000000006B4000-memory.dmp

            Filesize

            16KB

          • memory/2664-3-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2664-7-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2664-6-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-1-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2664-4-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2664-8-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-10-0x0000000000400000-0x0000000000784000-memory.dmp

            Filesize

            3.5MB

          • memory/2664-11-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-12-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-13-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-14-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-15-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-16-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-17-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-18-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-19-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-21-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB

          • memory/2664-22-0x0000000000400000-0x0000000000409000-memory.dmp

            Filesize

            36KB