Analysis
-
max time kernel
137s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 22:58
General
-
Target
064e045117d3dbd7387953637481757f.exe
-
Size
133KB
-
MD5
064e045117d3dbd7387953637481757f
-
SHA1
ada71055e992adbf559889cac78904976597ff50
-
SHA256
a394efeed89d1123899c57790056f695c6962d1d4da3d2e2f564a5f462bf4ef3
-
SHA512
f3f09f25d0fd923e0461c64eb45acd94d90426b24f322eab2e6368521b867fe33347b8b5bc06dd4ac672577aed0130b0c335aa3fbca226c793a26206a1b8ede2
-
SSDEEP
3072:DOTvkbEJj1ta8TkQ2A/DMvuSZihaJsXX6Xv+AmhPAKscLmkUbmstXtQ:DovkA51joZaAEQ2jAm6cLE7dQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\064e045117d3dbd7387953637481757f.exe"C:\Users\Admin\AppData\Local\Temp\064e045117d3dbd7387953637481757f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\064e045117d3dbd7387953637481757f.exeC:\Users\Admin\AppData\Local\Temp\064e045117d3dbd7387953637481757f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5b6048597d76233fbaf48659ce9b912e2
SHA1c39a19dc5406e94caa3bf10ab9b9092cae80165a
SHA256cd7e73076582619ad830bf21de758cdd5410301c15d64610b54a1da634918b4b
SHA512d80a4cfd46a63a02d7d688a3ef671e263cf1659ff0024faf0d3a4f178080f9f46ed5d7fa89ca47b49742a52ddb19f7543306fb5018b7f43a098c9420f015db5b
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
536KB