Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 15:53
General
-
Target
e303d62bb2216397fb1374bcdf6225cf.exe
-
Size
1.5MB
-
MD5
e303d62bb2216397fb1374bcdf6225cf
-
SHA1
711a9d500518047d13d3856d00ec1550b6284463
-
SHA256
7a6c79bb8ad2a4988074a3617aac723db1684ad3161c80551cfc0b943cbf25ae
-
SHA512
1d5c4350ed1b4ca52c09286f0f6fcfd187a33dadba3353d85da09ab681116c11a3164a0d32d93cc3c376104f09cb7640858a171a957460218431942accce33be
-
SSDEEP
24576:ukiqO/G0KD/cDxBncaz0OTFvq5jGqMPDH/uV2Q8s3iOsO6AX4rzsW:ukivNKD/YxBnPxvPr/uks3i3O6AWs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e303d62bb2216397fb1374bcdf6225cf.exe"C:\Users\Admin\AppData\Local\Temp\e303d62bb2216397fb1374bcdf6225cf.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e303d62bb2216397fb1374bcdf6225cf.exeC:\Users\Admin\AppData\Local\Temp\e303d62bb2216397fb1374bcdf6225cf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5efc80cc02f705cc0a613176f68d01dad
SHA11d693e7891ebaba22835e6569d6cc3ee20afdf4d
SHA2560973a513cdfc8c0e6533cdfc222df979e18127d2cf307d78395e5eb39ddb1759
SHA5128ea04a396d680223827cb1142eff1037c294700f3d5265eab8909c483627008e463005f9365707ceb21a5a5b61d5a15dde6d1057b3763fd3553443e180df07f3
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB