Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 14:11
General
-
Target
b9d82aef7eaab442ec0fa10908f9bcfa.exe
-
Size
133KB
-
MD5
b9d82aef7eaab442ec0fa10908f9bcfa
-
SHA1
4faa836f6d9ffd4f13af7ed0c321dcaa92d2f094
-
SHA256
1de4e780a63f1a4c832a6f4d6716a183f3359951b291d2792e4af9e4574f49b5
-
SHA512
f9e3cef6e92b947f55d4638d6a307e20fd97732539a6a296841422edf1cffce595cb18c6da2a6316b2ed71208ec0299c5f1e2f7b1cff3b41cba4ad4252883f57
-
SSDEEP
3072:8UxtrIlDq0QdLqtBSqQf5KpSrMYOMJQFo7W8I3HfMQ:pxKlDrQdLx75P4YPul9HfMQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d82aef7eaab442ec0fa10908f9bcfa.exe"C:\Users\Admin\AppData\Local\Temp\b9d82aef7eaab442ec0fa10908f9bcfa.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b9d82aef7eaab442ec0fa10908f9bcfa.exeC:\Users\Admin\AppData\Local\Temp\b9d82aef7eaab442ec0fa10908f9bcfa.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD58ebe2c7a3dc118638b0641af4a6a4ce9
SHA1600a2f17e03e83a0c816b9772976678510133e9a
SHA256aa015daa74499e9f112cf1bb8078d4607d399dc1e0b3544692fa6ffc6c0261b4
SHA5126db94a46ea76e08b144c4d3688702511af2c5600b63f6df70786ca361f0fa6549bc639278985a86c26895de26b4b921bcf345f37e8ce9a71f96a282c34acb3b2
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB