Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
22-12-2023 14:22
General
-
Target
bf04896f79ddb56541c7c6befd472639.exe
-
Size
2.7MB
-
MD5
bf04896f79ddb56541c7c6befd472639
-
SHA1
32f075233f54aa402e8acfdf7bdcbc2e9b3269a2
-
SHA256
dc5d7cabda83e06baf3a77ec7cf3269734f4b58bafb608bacac9cfb6ce38deda
-
SHA512
82b4c53f2686d996a79292a1a30123ba8abda3856383e1b1042d07cf9bebe7016a6c5c05c40b0105995a043a13aff3bea73018d4a1174c76988ab3d6195073e3
-
SSDEEP
49152:7DAcxecSc8yLwvDATR5mrmgUS5Gw2v10cInF6uKikMmybWw4UV2Pca:fABdlmwvDPUS5L617IFjEFzw9oP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf04896f79ddb56541c7c6befd472639.exe"C:\Users\Admin\AppData\Local\Temp\bf04896f79ddb56541c7c6befd472639.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bf04896f79ddb56541c7c6befd472639.exeC:\Users\Admin\AppData\Local\Temp\bf04896f79ddb56541c7c6befd472639.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5714e970306c937be5105536dc8438029
SHA18da72765972f0f11ce71413d63a64960672435d7
SHA25694b4b74710103f76e133fd54691853ad8cf4897827756de3cb123950495ae123
SHA5122868657afff7a4255b302ae8b6f379a5b576c6355ff1f1cf971fc4f7b3d36f75d0fcabb1faa2612b80f350d4e3f0da210791ac72b00a5bc05a39946282f56536
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB