Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 07:46
General
-
Target
7aad20a45c5f4a7990e71d887b477931.exe
-
Size
5.8MB
-
MD5
7aad20a45c5f4a7990e71d887b477931
-
SHA1
d0e9c72e1d3b0659af21fb28ca01803680e8d89c
-
SHA256
2ef5206affef3543aaa2b9d6e19e3254dd52681a5f492e9bd563d5efdf77219a
-
SHA512
fd5ed134d386398a3d8349ce49374ec1b7e3f848f58d0898c5aa11ca45f80f5e381783966ffdee0ac6ba8bc18fa76250eb4ef89488952d5f692438a86b75e83d
-
SSDEEP
98304:5w9MhsvAgg3gnl/IVUs1jePsBfICXXmmk2sIM97pYgtCgg3gnl/IVUs1jePs:5w9MivEgl/iBiPQIkm/2eHY3gl/iBiP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aad20a45c5f4a7990e71d887b477931.exe"C:\Users\Admin\AppData\Local\Temp\7aad20a45c5f4a7990e71d887b477931.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7aad20a45c5f4a7990e71d887b477931.exeC:\Users\Admin\AppData\Local\Temp\7aad20a45c5f4a7990e71d887b477931.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
MD56641e1112420b42a4563b151d95f9ec8
SHA1d3bdd904c84586728cc67a910ad6c49c4b4478c2
SHA256f91a639f100a88a6e72ba132d1d19902ae8c29a915eb1753042c5e7f26d3829d
SHA51222304f608e91b543d31a84f4e3467a1939f47fdfac862665d70c8020b7904ca25e8471aa8e469e2551d34b05919c5acc3d68e2793b54827386bc097c53a45cfd
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB