Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 16:55
General
-
Target
f9a0aef23e5614d1ca6fab9dca920f76.exe
-
Size
2.9MB
-
MD5
f9a0aef23e5614d1ca6fab9dca920f76
-
SHA1
c7f8316d870f3f071ed3a7c3cac365fa1feaf24e
-
SHA256
4e362f672bf9e0cd9a7310db8e782e41481d85af7e1584ede9ed8bcd2202ac14
-
SHA512
dc29a2d573a4ce5dbc211567e9b43bb52993bc286ffee551b280bcd6d9a48b80c3807ae25bf3a55ad34c9621410f40a33100e6a94c8b54af69415ecf0c128d23
-
SSDEEP
49152:u0UW6r6EEBpm62YOpFdzzk/6l+pFZesReo/xEcOvlzBfeL/O/LcaL/yVE:u0UbGEpY4FVzk/6l+pFZfN/xevdB+OIG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9a0aef23e5614d1ca6fab9dca920f76.exe"C:\Users\Admin\AppData\Local\Temp\f9a0aef23e5614d1ca6fab9dca920f76.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9a0aef23e5614d1ca6fab9dca920f76.exeC:\Users\Admin\AppData\Local\Temp\f9a0aef23e5614d1ca6fab9dca920f76.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
335KB
MD5738ab79f281666d40d6c8a5f306e8b05
SHA1cd365de695ccc1967342e465b51c990fe89d550c
SHA25679c7f9e5120c092df39fd9612f18c025fea6d126e82611c25706def9c82e2781
SHA512d09a2060fe7e7dd4f5ee8ee5e8d95f009d9cf130ab84f4c02e130951fc8e50d2dd7679f3865d7be0d7efb3047b6b046eba1f52498a67729bd32e529b76774679
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB