Analysis
-
max time kernel
139s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 22:00
General
-
Target
050a082dfa6f66617f3ce8bedc02b97b.exe
-
Size
1.8MB
-
MD5
050a082dfa6f66617f3ce8bedc02b97b
-
SHA1
3160f77441ecd75918d3d74e63c275ecdf3508bd
-
SHA256
5cf74525eb0425c0f56453101cdfa2184af21fa94c012a4e10b1f4eeb8bf6065
-
SHA512
00d1737bbbad8dbc5b8cbfb4363e87162ac2992cf2d4bcba5860ac37207964f4374733f0c0d72a12e7995d9f2529dd1b22214e0916133c6e389d43bd25e4aa9b
-
SSDEEP
49152:/M5D2KZgkuOIE5VUPYgk5CgC4DdVbhOwP:E5D2aOOhVUP99kdthOm
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\050a082dfa6f66617f3ce8bedc02b97b.exe"C:\Users\Admin\AppData\Local\Temp\050a082dfa6f66617f3ce8bedc02b97b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\050a082dfa6f66617f3ce8bedc02b97b.exeC:\Users\Admin\AppData\Local\Temp\050a082dfa6f66617f3ce8bedc02b97b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
942KB
MD55eb8085883b0a7a570d2154ebee71d43
SHA1efcc1210d0e8a754a2671a4df62e9405d1cba2b5
SHA25675a47b3f2c76485f8f70c1818c88c0634a50578cae04009b69d5a6e59b7f6b2d
SHA512f0defde362b9b036b2084db2eb9ef6207166f6b7230bf2df708c4dd1157c239e6f645a565d234f019e83ac84079a5cc32ec7d67a1183a93089395d60f66479a5
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB