Analysis
-
max time kernel
142s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 16:27
General
-
Target
efc5375e36af2d2754df1086dfdbec4b.exe
-
Size
5.8MB
-
MD5
efc5375e36af2d2754df1086dfdbec4b
-
SHA1
906787504dd0e1affa6eff58f843c7af0685153f
-
SHA256
0f4a6b1ca20b1846e96d1017796cc4ee26e330eb125648a0e4aeb8dbb5211306
-
SHA512
9b1c4b484f2008dbce6bb9996fd6701445bca7b620b98d6ad4dafaf661d12f7647d7a4f2f53ee8ca60bbc6cbd8474a0f422813f58fdccd53484ed0d0dca6500f
-
SSDEEP
98304:QKpodZeIjD4E1dcGQZaXhP5a9UEI+eG9jAkbkR79D+cVItGQZaXhP5a9UEI+eG:QMQZPjbSGhRaaCkN9qHGhRa
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc5375e36af2d2754df1086dfdbec4b.exe"C:\Users\Admin\AppData\Local\Temp\efc5375e36af2d2754df1086dfdbec4b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\efc5375e36af2d2754df1086dfdbec4b.exeC:\Users\Admin\AppData\Local\Temp\efc5375e36af2d2754df1086dfdbec4b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD596bcbd50e73f82d3f2bfcbb56921c973
SHA1cf8905a26354da882d9e7bc199ecc5cf39d004bf
SHA25697dc88c5fa11e13f0435bbf78a11b79ad5e74d84f643a31253622d30cb4987de
SHA512bba5f2fd9ca735e1ef3cd4fe1cf342844488feef1a2f4944d65f067b2cb1e61196d4b581b39f93e7a227ae961fb0f928ba6159c646db3d1e40ff363aeeaec2b2
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB