Analysis
-
max time kernel
173s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-12-2023 15:33
General
-
Target
79386ca38ac71e66670f0c4198d3e954.exe
-
Size
169KB
-
MD5
79386ca38ac71e66670f0c4198d3e954
-
SHA1
0052403ccf870d23bbee349ac537d646cdd83ea1
-
SHA256
4ebd5830e848c4824dc5d632446a1fada7924ce12cf87d5ff09908ea2531172c
-
SHA512
a06b74451f78b0015a7a533ebc81d8f01e391d3b1686a25d8febbfb77d9aff8403667b1f47ee52dbf425d8abe97b63839a7c9e8f6b0dba43f1bc8082487b52dd
-
SSDEEP
3072:Tl2hMeZEtrmhRrZBfRnrvfx6nSgVpWd+F2M46X6t1e75bCyZ94hi1ffHef0ZgUKX:Tkh4mh9ZBZnc7Vw+F2gX975jUEeseUTe
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79386ca38ac71e66670f0c4198d3e954.exe"C:\Users\Admin\AppData\Local\Temp\79386ca38ac71e66670f0c4198d3e954.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\79386ca38ac71e66670f0c4198d3e954.exeC:\Users\Admin\AppData\Local\Temp\79386ca38ac71e66670f0c4198d3e954.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD523adeac014c816108cb935214b1874e8
SHA1610bb7f3f69a90e4d51152d08fb30a6071b5e369
SHA25616c92302e5748ea659d0bcc8baf346eaeca6d7fac4c7223495e719c4cfe7f01d
SHA51290422f952b7339296e214cad946b77a215b6eaa00c407800ea83b72d67996785b5bc3e7c24710ac45cf49c68508fbd7e3f566451996dcb371e3f4a702b08a7cb
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB