Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 02:49
General
-
Target
560d5d13c51df5f461d7d033b50691c7.exe
-
Size
1.3MB
-
MD5
560d5d13c51df5f461d7d033b50691c7
-
SHA1
158c3ab72da37f323863264a59267715e9f16709
-
SHA256
14788a4655af98cdfbf20d3c137784966872cb118fc64e69c88315ede59919fb
-
SHA512
f8d26ab39a2ba3a87e952338dbfa2e6d2b544b89f680737257e7af593a2f98f711a1f21231cd3d2e1c5695e3d1383d95dfb7f4893339e5e89e517ded67b597ac
-
SSDEEP
24576:gRhc9XpXz1/EEyQBgeKZIYcvL6g72WN8ghSIa8zTr1jQbQNL+PkU9/9Us:gRqXZNueK2972WNbBa8z9j4QNL+7R9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\560d5d13c51df5f461d7d033b50691c7.exe"C:\Users\Admin\AppData\Local\Temp\560d5d13c51df5f461d7d033b50691c7.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\560d5d13c51df5f461d7d033b50691c7.exeC:\Users\Admin\AppData\Local\Temp\560d5d13c51df5f461d7d033b50691c7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
467KB
MD5fc875081b42f9605bd27ba3d35676bf1
SHA1686638b26a627cf60a43696f1af20bbe460d98e7
SHA256205d862218d9727bbaa46d7d9bba5f741c2d688ac9eca7452d37d4c2684fa202
SHA51298d1ec039aad58c1492642ccd52fcfa5f7be9670bcb5cf29b85311ab629dd28f114795ed44e842030e65c3654eec9c00388cb914f0e6bc83b8dc7dfaff0b4d7e
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB