Analysis
- max time kernel
111s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/01/2025, 04:29
General
- Target 00568846d9be17f347a4113275ac3eda8e7bd7c359297ec07a27bf21925bfaac.exe
- Size 662KB
- Sample250108-e4kekatqbt
- SHA256 00568846d9be17f347a4113275ac3eda8e7bd7c359297ec07a27bf21925bfaac
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- UPX packed file 54 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00568846d9be17f347a4113275ac3eda8e7bd7c359297ec07a27bf21925bfaac.exe"C:\Users\Admin\AppData\Local\Temp\00568846d9be17f347a4113275ac3eda8e7bd7c359297ec07a27bf21925bfaac.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
grey_btn_hover.png
bootstrap_24074.html
main.css
progress-bar.css
bg.png
close.png
close_hover.png
color_btn.png
grey_btn.png
loader.gif
min.png
pause_btn.png
progress.png
progress_bar.png
resume_btn.png
PT.locale
memory/2520-178-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-180-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-108-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-107-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-7-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-135-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-117-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-134-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-5-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-147-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-153-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-120-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-118-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-116-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-115-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-114-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-109-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-6-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-2-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-0-0x0000000000401000-0x000000000040B000-memory.dmp
memory/2520-1-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2520-154-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-110-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-152-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-185-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-176-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-179-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-121-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-181-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-182-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-183-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-184-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-177-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-187-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-189-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-191-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-192-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-193-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-194-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-195-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-196-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-199-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-200-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-201-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-202-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-203-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-204-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-206-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-207-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-208-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-209-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-211-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-210-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-215-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-216-0x0000000002320000-0x0000000002476000-memory.dmp
memory/2520-218-0x0000000002320000-0x0000000002476000-memory.dmp