Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-07-2024 14:27

General

  • Target

    05085cf27b16756252da882476a1a3b0N.exe

  • Size

    5.8MB

  • MD5

    05085cf27b16756252da882476a1a3b0

  • SHA1

    1052b9a8cca33a3f99ee065bf3f0c9a97427a1b1

  • SHA256

    f73671ceb1a1aab60faf38593282c281877f46c66f3a7ca861dfa75a2d9b9c8c

  • SHA512

    52ab41fc2e93736e32b1298cf166a29e657fca7596644f79a1a6a8f8267d1763a17e0e50bc1c30cca937f3b40a21234a91de79c32b110ccaff60abba5764bf90

  • SSDEEP

    49152:EnQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ/:4

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05085cf27b16756252da882476a1a3b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\05085cf27b16756252da882476a1a3b0N.exe"
    1⤵
    • Drops file in System32 directory
    PID:1172
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    6.2MB

    MD5

    cb5496988292cd42cc84aceac5c21da4

    SHA1

    8f0c1792d90b68d0176f99c07d05c281e5482e4b

    SHA256

    805a3f5f9a83807339c30897b3736adbcb8f0658e342edeb0ea62c46f43ebb1f

    SHA512

    130fa30c75883f70de62ffabce674380f48c7477f985e6a590a9466fc1fb72eaa3cade9abaadfccb917390f368340b4f3ead722b6324e454d419564075ea65ec

  • memory/1172-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1172-2-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1172-1-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB

  • memory/1172-9-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/3648-6-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB