Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 17:10
General
-
Target
fbe8e108225cac785b0685200a6e98a8.exe
-
Size
2.7MB
-
MD5
fbe8e108225cac785b0685200a6e98a8
-
SHA1
689872edeb84504aadf558aa9b121765f827c1ab
-
SHA256
0ac33151d329fde8346fe102da9ad43efc3229befd84a3d30a2c9925b1f8eccb
-
SHA512
4f558fd35a77d1b98846f62c3e2a74ab75739429654eee0a347db13e1ba76d65fefdeb203f252a37fd6e1a248dd859b24b6c5109f0b7cf719a150a2e76ad3647
-
SSDEEP
49152:B74+ptLXS3nJfqRCzsjbvdR9S/+CJRCpE1EkKlLEK3zeEo2s+uFCR9j:B7zLXenNqAEbvdHS/7EEmpfjRRbuAHj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbe8e108225cac785b0685200a6e98a8.exe"C:\Users\Admin\AppData\Local\Temp\fbe8e108225cac785b0685200a6e98a8.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fbe8e108225cac785b0685200a6e98a8.exeC:\Users\Admin\AppData\Local\Temp\fbe8e108225cac785b0685200a6e98a8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD566129fb117d74061cda2670155e8378a
SHA13bfd4c45625ab55a7ebf618cf47d9a64ef1afa43
SHA256d6f24c2f2b93a8f64eac0f51dc351a7540f2a0234a40e9a6d486c7edc073afab
SHA51250ccd60ff55896c5cfef537d300f7a94eab4829d7d2507f8cdc6edd1d1baf134747ebf1afa00d07ce5c8a80ba0ed21f84ff43680fa53a7cd8aa36371fc730d42
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB