ca62b5a330bfc3ffb0b38396044e552b0812761e4c86636ef81d6ce8443e9aad | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tunneld2/Master.exe
Size

331KB
MD5

50f112462809a25174f2847c8000280c
SHA1

79e83d59cadd2e3df9b85c5273fa14e9d3209fed
SHA256

f09ef0b24e443f48743814af780adc86de041d9c3e3820f5b3bc0fac558b8366
SHA512

a4777c85d092c41e2e8ffd31c39d5dbcd7fc202e51392b816e535e0b170ec12a6df69045bc967e398542afbef9c085635f7a46e41025710b072d177ac441cdf1
SSDEEP

6144:mppSxMCXL+95mHZhOMfO2K2IfT290vcTNum+fl6fzS:WIXC8nL6zcTY4fzS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5048-0-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/5048-2-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5048	Master.exe
5048	Master.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5048	Master.exe
5048	Master.exe

C:\Users\Admin\AppData\Local\Temp\tunneld2\Master.exe
"C:\Users\Admin\AppData\Local\Temp\tunneld2\Master.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5048-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/5048-1-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/5048-2-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/5048-4-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download