Analysis
-
max time kernel
141s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 14:07
General
-
Target
b780354f3a7f69f73339a0d15599150e.exe
-
Size
11.7MB
-
MD5
b780354f3a7f69f73339a0d15599150e
-
SHA1
fe29f00c16bd0d5f1ab66041de76ed113ad227cd
-
SHA256
f87c4ceb7286098bf696dbb16c67d2e0b8247eeb6084151a83276d6971c065b5
-
SHA512
336e2e1e81f83b3ad8f8933bced651181ac9939b51f3bc69d224855630361437dfafa8b7162d2ad043b351c3bf18d259d725051d2ecd8aed4204c220f5e9a7b5
-
SSDEEP
196608:yKXjpFauq1jI86017sq2oFAwPauq1jI86Gs6jauq1jI86017sq2oFAwPauq1jI86:yKXNplH072oAelHvulH072oAelH
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b780354f3a7f69f73339a0d15599150e.exe"C:\Users\Admin\AppData\Local\Temp\b780354f3a7f69f73339a0d15599150e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b780354f3a7f69f73339a0d15599150e.exeC:\Users\Admin\AppData\Local\Temp\b780354f3a7f69f73339a0d15599150e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD56e0e2a70a79d1103198239bde18271ea
SHA108fd208da1d8c4dede8c027fa39bdfd565daa7f5
SHA25658de630c80985ac56774220f60150033b8425dd6ff0bf362fa8c7ead4e684a4c
SHA512d83a7f374f4970ffcebdf352f3049633a515fc0e7fead4d39e2e7bb902f4db0e00eee76c22a9578e56939bc70fa242fa47b56539c1593c04f8f51766581417df
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB