Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 19:56
General
-
Target
39a0ca7b4198b9d9088d872a0892f257.exe
-
Size
2.9MB
-
MD5
39a0ca7b4198b9d9088d872a0892f257
-
SHA1
42500866dc49adc341452c9b190cea9f9a4af13c
-
SHA256
96fcbc2e18d19567891dbd27a6a8311a61b7536840bf054fe955eacd8a35ad8a
-
SHA512
c82ebfb4cbd24c831eed43ec2e1a80931f8c00900b1b302b00677ec11054a7dcd428fc4ea6ecb449fa78f515a99a411dc23c6a1ec1c725448672618dcb886346
-
SSDEEP
49152:XGTi2j0z86jSeVFLU3l0QmXcDgfC3p4N74NH5HUyNRcUsCVOzetdZJ:WT5j0MeVK3GNRmi4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39a0ca7b4198b9d9088d872a0892f257.exe"C:\Users\Admin\AppData\Local\Temp\39a0ca7b4198b9d9088d872a0892f257.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\39a0ca7b4198b9d9088d872a0892f257.exeC:\Users\Admin\AppData\Local\Temp\39a0ca7b4198b9d9088d872a0892f257.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d89fb9f542b3c7a6ca0d5b3e11adb35d
SHA1786d9c81b265938b314d394eec78c1ec4f59faca
SHA256ea83932fd3d0728b81da13fc730ee19f514df9a54790de792b8175eddb97ac21
SHA51228b17c8c301dee3596e5722276a89289d8cdf4dee2814ddf68a6408fbc841f0ab01100bb339a9e5b569c1ad4cd12b1decd981bae34ac6805b8d69230657b9b60
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB