Analysis
-
max time kernel
165s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 14:06
General
-
Target
b745a6dca889884211b2d16e6eb62b28.exe
-
Size
1.4MB
-
MD5
b745a6dca889884211b2d16e6eb62b28
-
SHA1
4284c2ebcdf552ac60e71b8023a535659ce8c075
-
SHA256
0638e9c3278080f0aff66d1f8fcca5564cb0fcec5645143406cd712570d0b28b
-
SHA512
67a9a644bc29d127e00e0715290c21d626fbb0706f6658e3d5a50bfb6a35690fc8f265b0203787ae6ee59de5dac6d226ca8610773a45d1e158fdc3d0706aea47
-
SSDEEP
24576:oaPpECOHokwAAHoV8XE+Z3ajCGWlzjY1dicRTBRIV13hz/2Vts3hW:oaLAK90+5aGZlz4i0TBu3h/2fyh
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b745a6dca889884211b2d16e6eb62b28.exe"C:\Users\Admin\AppData\Local\Temp\b745a6dca889884211b2d16e6eb62b28.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b745a6dca889884211b2d16e6eb62b28.exeC:\Users\Admin\AppData\Local\Temp\b745a6dca889884211b2d16e6eb62b28.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
765KB
MD5de37757f93979075b4c2ffe9baed76bc
SHA1f9d22f9aa3d2d01635ea0e53105f18b8329206c1
SHA256db9f7f6224f14891934c526fdf10fc79421f0d0e1b5174320b1554c3ff335dd6
SHA512c57ce051df9e476bf6c4245ce93882f21d8b15222730e28c829a14211a75a6329bea7e41298e63d9c72be84aa7efc44526c50aafe2efa09ac4889d6cae464503
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB