Analysis
-
max time kernel
141s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 07:42
General
-
Target
7a7545506f8d63f26aac78e541d3c5eb.exe
-
Size
2.7MB
-
MD5
7a7545506f8d63f26aac78e541d3c5eb
-
SHA1
462a2f6db190d4ca0d29990290f4f61d1adb39d7
-
SHA256
972f5a0546d5df00a53f0625e563f2448eaadea8880ea137d7a9390f831d7ab6
-
SHA512
99f1ef06262654e7e461ca66ce74355862afebfd13a05f6064cb6931aba801234a22367a26ecb9213db1d7aa690a97b97b8d99392e4ad7219b85d30ae6a68515
-
SSDEEP
49152:PFfmzwbwV3g/6MSxCc2rR9ktBc1+Q4YdxSChG38bDUggR9t:P90wbsgSZCc2rHktBcwQDM2YIDULHt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a7545506f8d63f26aac78e541d3c5eb.exe"C:\Users\Admin\AppData\Local\Temp\7a7545506f8d63f26aac78e541d3c5eb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a7545506f8d63f26aac78e541d3c5eb.exeC:\Users\Admin\AppData\Local\Temp\7a7545506f8d63f26aac78e541d3c5eb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5df66080f4adb164421a8752068da8ea5
SHA1c416d2eef3ee2e0e241d27fbbbd9305faff3ea99
SHA256f6c0e3252187e7b00e6dbbaa6932f09a7bb7e39dacb5f12d80ddfd11cc540433
SHA51207520cbd607beca7d6317be53b8e2483a2e2cc61b65712110a946f635d1aa89cadbab3a11050881af1cb3264c34f0aa2bfa5aacfaf3f6e028532c654b889a6a9
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB