Analysis

  • max time kernel
    46s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 07:56

General

  • Target

    426506c7ad294094d23395fc69dd8ea790a189dc611e407942697e430cc313d5.exe

  • Size

    9.1MB

  • MD5

    10170adaf9b93a9af69026d29a7958c0

  • SHA1

    5935f7c9aab33a66ed925767ebf998b41b5acef7

  • SHA256

    426506c7ad294094d23395fc69dd8ea790a189dc611e407942697e430cc313d5

  • SHA512

    c2ef66631735c5a71f7dde9633f56ef18c00b6ef694653f88916e3b4bc9b8fdcfa65e7d9b7dffbd93c7b0af66b73c63c7a5abc832d50f40ec8a952662a47f94d

  • SSDEEP

    98304:llg4444444444444444444444444444444444444444444Z:lH

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\426506c7ad294094d23395fc69dd8ea790a189dc611e407942697e430cc313d5.exe
    "C:\Users\Admin\AppData\Local\Temp\426506c7ad294094d23395fc69dd8ea790a189dc611e407942697e430cc313d5.exe"
    1⤵
    • Drops file in System32 directory
    PID:5072
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:3328

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\svrwsc.exe

          Filesize

          9.5MB

          MD5

          618cf5a95af16d37182299e29fa8c53f

          SHA1

          6bca1abea808b38e75bb7d45fbee52e1a90cce87

          SHA256

          99e91671696a2f1d06875084b4debe650a9483111d05791ac1ef1d5441df779d

          SHA512

          6fae23bd37ca5327b0e6674e83797e5a90c3793ced575f63abf6afee658f99e58ad3b6c419015563fd163393a758c4b6f480bc47d97af216ba61ddd05815bba9

        • memory/3328-7-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/5072-0-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/5072-3-0x0000000000400000-0x000000000042A000-memory.dmp

          Filesize

          168KB

        • memory/5072-2-0x0000000000790000-0x0000000000795000-memory.dmp

          Filesize

          20KB