Analysis
-
max time kernel
158s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 22:08
General
-
Target
0532fa47d470b34c2e0f4207c42bcf85.exe
-
Size
2.9MB
-
MD5
0532fa47d470b34c2e0f4207c42bcf85
-
SHA1
7dba0f0ee59f9c3996085ed900a2738f08225331
-
SHA256
707c81bd5581efb6952fd2bc1a030f6dd68d2b5b2515ceff1f2e75bbdef1a3a6
-
SHA512
b5d7bd01677761ccfdec14a00e7a62463e02d7408abe32aa3b520ab581dd3fd2fc9d13526a15ad7a244f41edf17243ad48642a6012a5835e0b207822c5970da5
-
SSDEEP
49152:vHxWsliSYwkEa6Sa2KP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:5niQkva2Kgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0532fa47d470b34c2e0f4207c42bcf85.exe"C:\Users\Admin\AppData\Local\Temp\0532fa47d470b34c2e0f4207c42bcf85.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0532fa47d470b34c2e0f4207c42bcf85.exeC:\Users\Admin\AppData\Local\Temp\0532fa47d470b34c2e0f4207c42bcf85.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798KB
MD506b8baf3dc6d576c89456b2c84308f2e
SHA1cec030c2125dbc9e71ee1cae3189dacd6f71ac16
SHA2564059c3e4b9067aa4c54f4a6ad20589b1c88d5c9a2d2faf17e96b772b2e1145fe
SHA5129670b69ee4e2eb19f62bd31a358d3098015a01ea0e9620a607f32097aaf1c90737416166c05f1541eece24baf2949a71ff9dfd72c0277ff1b83653209477e015
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB