Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 14:35
General
-
Target
c749b89de1dcf83f90f65d0208b7afd6.exe
-
Size
1.3MB
-
MD5
c749b89de1dcf83f90f65d0208b7afd6
-
SHA1
2986efb96482c25f2c2f4ac40d472bf1b0f8a0b9
-
SHA256
e66cf44e428d0ffcc0de5e35b33611eb0940c59159e86a6198621006d802e0f8
-
SHA512
5a60c6f5dd1e91ce0ad1a0a0ec00cee872a765737946525c10b14ff100838240d65a814d93fc5df6c7e9b0717336a880a72ebf65a80ae52f3a20b258f6ed1282
-
SSDEEP
24576:JSlD919q6z38baXMRs0D2JO0t7Xyh5+1vxzlKw5p+C7I1opCU9/9Us:JADUb9C0D2Uoh1vxsS+C8eR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c749b89de1dcf83f90f65d0208b7afd6.exe"C:\Users\Admin\AppData\Local\Temp\c749b89de1dcf83f90f65d0208b7afd6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c749b89de1dcf83f90f65d0208b7afd6.exeC:\Users\Admin\AppData\Local\Temp\c749b89de1dcf83f90f65d0208b7afd6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD558a48e0e4c5c62569d71f0eb8c0eb7d1
SHA1cbce630515bccd9dd17371b30fd8a1c9e6536bd1
SHA256dcdef4815fbc4160f68fa8fc4004e2d2a51d72545a3c874d283ef49531622982
SHA512baa2b97733fac06f716738c0f64f7b245cd3595916777f0d4900927245da2d8c321550d71b05348b1b435f28df2e3ab7bf2f7b12cf258a5adeb6f0a17d9c3f50
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB