Analysis
-
max time kernel
144s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 04:55
General
-
Target
6ab8f45dddbc5bbfaf55aa7e0c64b90c.exe
-
Size
2.7MB
-
MD5
6ab8f45dddbc5bbfaf55aa7e0c64b90c
-
SHA1
555efd47b14d9bf4c0c62f653e48982fb491bd87
-
SHA256
90a1dc5d46606abf16047455f3ad5f991a8cb0ada9036c6d7976feabea22465c
-
SHA512
26905546b4a648300ebda37a63d65f244f86d839974c6d35d8d8ee1643abb8963f73dfcb8d17925fef41a922fefee31d5cf0646340a1b432d8fe8167ff42bc44
-
SSDEEP
49152:deZHttetRqCT7eZPx6+M/lK4khBrml+hywR9kXJ4l8IBEQQaVhorSbgQ20rR9j:wtQtRpep8+M/lmBrLywH64lIwhS020rD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ab8f45dddbc5bbfaf55aa7e0c64b90c.exe"C:\Users\Admin\AppData\Local\Temp\6ab8f45dddbc5bbfaf55aa7e0c64b90c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6ab8f45dddbc5bbfaf55aa7e0c64b90c.exeC:\Users\Admin\AppData\Local\Temp\6ab8f45dddbc5bbfaf55aa7e0c64b90c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD519614006bdae969c4a89ebda21b068d9
SHA1fbb24790cfe031193d050a14c13a0351d94ee314
SHA25607be0a08c51f7f82aa56806d823883a494ff9cb6648869aa6e3d611702e19959
SHA512f7d66968ece190d740b8e4603bb806dd589ea2a9045f7d19a686a38bf6467ff314fa2f39321b086b60ff58800451512f132c762e0e0a314c67982e50bc093835
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB