Analysis
-
max time kernel
163s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 09:57
General
-
Target
8322fd4b3fc93f6779777f95a6cb04cc.exe
-
Size
5.3MB
-
MD5
8322fd4b3fc93f6779777f95a6cb04cc
-
SHA1
17535634a3e5420224d1ea9590ce5db03b9d8e9f
-
SHA256
1d8108975b6a3a84eae8ade2c0cc1b7bb85d22b3fd99156dfaf641ab397179e9
-
SHA512
16ba9e482775efbc98ffe4e2a04b9d9a97d76380a622193fe15a1a7748f00e1b1325b89d9b1a8d3f84919953453dba4fbf67fdf22bfe60efc474740367d73298
-
SSDEEP
98304:hUh/q2N4dUPxljvMeK/xxNmJs9ElpYq0T/LEr60jvMeK/xxNmJs9Ef:hQqmiU/MeK/x9cOq0zM6iMeK/x94
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8322fd4b3fc93f6779777f95a6cb04cc.exe"C:\Users\Admin\AppData\Local\Temp\8322fd4b3fc93f6779777f95a6cb04cc.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8322fd4b3fc93f6779777f95a6cb04cc.exeC:\Users\Admin\AppData\Local\Temp\8322fd4b3fc93f6779777f95a6cb04cc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD573412085cf83f80ac021d2f7bcb17b8d
SHA1acc3a150bc7eb733ec2ca9a1aa951b13d65486fe
SHA256af54907acb06efe024a73a0fa6e90cbd380ccf3e71d8bddcbd70ff41b6d0d5cb
SHA512b30096f1f4451f6abaa95b01a305187eab64e79de88117c92e60eb5dfb45753245739a4e50fca1704ae18b51e96f5ff9214a0739a8906714e543f56e2e9416e8
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB