Analysis
-
max time kernel
147s -
max time network
83s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-12-2023 17:33
General
-
Target
08a9d37ad87d7f5f0048e3cb26436a5c.exe
-
Size
1010KB
-
MD5
08a9d37ad87d7f5f0048e3cb26436a5c
-
SHA1
9f47aa53901735f012409618ab57a08a026f2b93
-
SHA256
9b726eaea828875a76edecdb76563e57c16e5302cf7cf7983baa058915b8fa97
-
SHA512
35aca76060c41fe5373325b6bb1574ff3b856eaafdd423b41541b09fc698b443b6c12ed1e7b8d8115d174dfaa4da735d0430ed2b0281bc5ff61bbd4fee65ad90
-
SSDEEP
12288:9yBqSDUCa48MZUP+YTfmQOohSdgSH1KTAOPBo3+zHYTfm:kD4ehmfBhShH1EAemf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a9d37ad87d7f5f0048e3cb26436a5c.exe"C:\Users\Admin\AppData\Local\Temp\08a9d37ad87d7f5f0048e3cb26436a5c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\08a9d37ad87d7f5f0048e3cb26436a5c.exeC:\Users\Admin\AppData\Local\Temp\08a9d37ad87d7f5f0048e3cb26436a5c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD50cc276fb67bcd076c2e8577acece324b
SHA1f77da7fe235684fd4fb37e26aed671822781adc0
SHA2565a87e761bace49a5b8251a85561f517aeff86c495d4e4529ac2961174f37aac1
SHA512c96190bae1baff1ff6b7832ca4c19ac800d4b0965c66f794d74ee672d27e0ecf655803488d7f22f59604102e1f32cf416d3f72015abbba7d5e4777c37e4d0ef6
-
Filesize
264KB
-
Filesize
320KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
320KB