Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 14:33
General
-
Target
c5ee57ca9f291853b25368f5adf6c129.exe
-
Size
10.6MB
-
MD5
c5ee57ca9f291853b25368f5adf6c129
-
SHA1
7ba083af8427df77dec56e6f97802f7712bce820
-
SHA256
1b9481b0170ff90b92a13f8256f0f5b059cd341c2c054637cec2e1a6e7184290
-
SHA512
38d3e5aa83ff4191577bc2e78e53304fefa008fbecc83552f6d9abd5757db4186eae9869023424253959f5a4582d97b24cb8cab3e589ad43b35925619733a7fd
-
SSDEEP
196608:Oj6EJzXtsAutVlZAO7ir1bdmzXtsAutVlZAyFqDSbU6q54zXtsAutVlZAO7ir1bq:lU+jQb0+jL8/6D+jQb0+jg
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5ee57ca9f291853b25368f5adf6c129.exe"C:\Users\Admin\AppData\Local\Temp\c5ee57ca9f291853b25368f5adf6c129.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c5ee57ca9f291853b25368f5adf6c129.exeC:\Users\Admin\AppData\Local\Temp\c5ee57ca9f291853b25368f5adf6c129.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5e8916d586580863dd8c9b3e7a0ab8ce4
SHA10f0a94edb57b30725c55f498897298f75804c8e2
SHA2561a3b1173447a5c02b2706d5a68f617a61d7ad8065f1dcb787dd7eb5ba340fd4d
SHA512e6ac11e680fc877441d8f6e4aae26bb3b97074a1427215beeadf5d7197c38a703d5559a0b52d85d36ca518fb6e4b69bff2a2a7500681964e0494064679e2c468
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB