d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461

Analysis

max time kernel
145s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07/07/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe
Size

5.7MB
MD5

351c0fca05d6d3808ff61b30ace8680a
SHA1

4a1e599efeba9095b913844562e85b57eac0a8d8
SHA256

d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461
SHA512

b20e362b676e110eebcb79e14b86175840640d9069e856a78eb09848ea6447ebacd43c8facd96ac26366e4997b5bb70b2764d9a27abb8c77c788eb3cef73c3d0
SSDEEP

98304:g65+e06rpv7iKCunJAxzKSLiaNtLDOikmmtqN3PhZiUNodlLqJnr12N4cjVIPuL:55+e3soJA9KSnNRDO1mqqNGImleJkHOm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3368-0-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/3368-1-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-2-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-3-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-4-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-5-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-6-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-7-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-8-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-10-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-11-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-12-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-13-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-14-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-15-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-16-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-17-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx
behavioral2/memory/780-18-0x0000000000EF0000-0x0000000001F16000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3368	d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe
780	d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	whoami.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 780	3368	d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe	81
PID 3368 wrote to memory of 780	3368	d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe	81
PID 780 wrote to memory of 2916	780	d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe	84
PID 780 wrote to memory of 2916	780	d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe	84

C:\Users\Admin\AppData\Local\Temp\d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe
"C:\Users\Admin\AppData\Local\Temp\d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe
  C:\Users\Admin\AppData\Local\Temp\d4fe89b4b2fa41d85918624bedbb337d4dc132c9912c4fa95b444da639866461.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-8-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-11-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-2-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-3-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-4-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-5-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-6-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-7-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-18-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-17-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-10-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-12-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-13-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-14-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-15-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/780-16-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/3368-0-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download
memory/3368-1-0x0000000000EF0000-0x0000000001F16000-memory.dmp

Filesize
16.1MB

Download