Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-12-2023 13:04
General
-
Target
70b9c5d137ca9437858e8c2f007e66d6.exe
-
Size
59KB
-
MD5
70b9c5d137ca9437858e8c2f007e66d6
-
SHA1
23a9961be1177ca4730626e280078d6205c3d1c1
-
SHA256
07e2531fee5f12d9e580b081f3b2d19911435045e7329e1283cfb77101c456c6
-
SHA512
612a9a5212f7c396d69cb46190d445a412e9b82c475c2663269c4336f8a96622199b4d7a51b90c3651ba159e1eaeb7c068346cede5e65b0194afe679dea4dddd
-
SSDEEP
1536:F0M5uxmhkMkvuDvyegDBsNoMN4NUyBUrxHaRm/RhlS:FCmhkR2DKeCaoG49KrxHJpho
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70b9c5d137ca9437858e8c2f007e66d6.exe"C:\Users\Admin\AppData\Local\Temp\70b9c5d137ca9437858e8c2f007e66d6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70b9c5d137ca9437858e8c2f007e66d6.exeC:\Users\Admin\AppData\Local\Temp\70b9c5d137ca9437858e8c2f007e66d6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD52d9051d37a9428ab8d0f52bae60661e6
SHA11dee176ff7baa232f6dfae633010b367315992d9
SHA2563aeb16048bd2acc6ef73b4d7284ad6fd8ff12d0eb86bf7f2c5cf07c6b91c73e2
SHA512794c1708aeb78f1eac4fe1f74b12695f9a984ca0818f8e251cab24dbc186a2c674891b4c41574b1b0ba82529b8f04503a74a9460c669c6cb56a58aa77c3d7e00
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
244KB
-
Filesize
244KB