Analysis
-
max time kernel
130s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 13:51
General
-
Target
afc4f96b05b7bca79e6440bdd04ab7ce.exe
-
Size
2.7MB
-
MD5
afc4f96b05b7bca79e6440bdd04ab7ce
-
SHA1
eaa5b45e298d9216f66ab9d86d3c9edac0f3fad3
-
SHA256
934467558c7f5e524f1b60b4c7489276d04511d418899f90203f08ca4a64ea9b
-
SHA512
427b6d8129848327fc2f87e04b365238a026c344960fccdfe9a23b564dc6eaf812ae9dffee3d1b0a09127fd785ff61f4c909eacb1639cbd86a87d980c645e1f5
-
SSDEEP
49152:G5514GLst9MHGk5/P/TNbmAVffrZolfWyIReJ6Sp6jpwjSe6VMq5a0a9Srf:O52JmGk5/P/ZmAVnrZolTYSINmwe0Awf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\afc4f96b05b7bca79e6440bdd04ab7ce.exe"C:\Users\Admin\AppData\Local\Temp\afc4f96b05b7bca79e6440bdd04ab7ce.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\afc4f96b05b7bca79e6440bdd04ab7ce.exeC:\Users\Admin\AppData\Local\Temp\afc4f96b05b7bca79e6440bdd04ab7ce.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD5ce0f847d08ab74879a969faa497d91ef
SHA1627d309e0d3ccc0155aee72b8020abc4761ed399
SHA256ee2f51ba398b6f9c39b61b7623dfc67b0b18c47da76c4229a29a450231871b18
SHA51286ce3d58e88074efc8a6548c62e0d50486e3e20f5157051c113f2dc102a8794db9d6b8be8a7bafb966a50d1cfdec68c338e6c84031d54ee3689cca2ba18a500e
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB